df-sandbox-test

Security test fixture for the Dependency Firewall sandbox scanner.

This package simulates every detection pattern the sandbox scanner supports. It is completely harmless — the domains and IPs it tries to reach are not registered or reachable, and no data leaves the machine — but it exercises all seven runtime detection categories so the full detection pipeline can be validated end-to-end.

What it does during postinstall

| # | Category | What it does | Expected finding | |---|---|---|---| | 1 | Env var harvesting | Reads NPM_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, etc. | sandbox-env-access HIGH | | 2 | Sensitive file reads | Attempts to read ~/.npmrc, ~/.aws/credentials, ~/.ssh/id_rsa, ~/.gitconfig, /etc/passwd | sandbox-file-read HIGH | | 3 | DNS exfiltration | Looks up c2-beacon.df-sandbox-test.io, exfil.df-sandbox-test.io | sandbox-network HIGH | | 4 | HTTPS exfiltration | POSTs payload to collect.df-sandbox-test.io:443 | sandbox-network HIGH (DNS query captured) | | 5 | Subprocess spawning | Runs curl and wget with the C2 endpoint as target | sandbox-exec HIGH | | 6 | Dynamic eval | Base64-decodes a payload and eval()s it | sandbox-eval MEDIUM | | 7 | Raw-IP connection | Connects to 203.0.113.99:4444 (RFC 5737, never routable) | sandbox-network HIGH (IP extracted from error) |

Expected Dependency Firewall findings

[
  { "category": "sandbox-env-access",  "severity": "high",   "description": "[email protected] read sensitive environment variables: NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, ..." },
  { "category": "sandbox-file-read",   "severity": "high",   "description": "[email protected] attempted to read sensitive files: /root/.npmrc, /root/.aws/credentials, ..." },
  { "category": "sandbox-network",     "severity": "high",   "description": "[email protected] attempted outbound network connection: c2-beacon.df-sandbox-test.io, exfil.df-sandbox-test.io, collect.df-sandbox-test.io, 203.0.113.99:4444" },
  { "category": "sandbox-exec",        "severity": "high",   "description": "[email protected] spawned suspicious subprocesses: curl ..., wget ..." },
  { "category": "sandbox-eval",        "severity": "medium", "description": "[email protected] called eval() during install lifecycle" }
]

Usage

# Run the sandbox scanner directly against this package (no server needed)
cd /path/to/df
make scan/sandbox

# Or publish to npm and install through the Dependency Firewall proxy
npm publish --access public
npm install --registry http://localhost:4873 @wobblyboots/df-sandbox-test