@workleap-nav/components - PoC Malicious Package

This is a proof of concept package for testing dependency confusion vulnerabilities.

⚠️ WARNING

This package is for security testing purposes only. It simulates a malicious package that could be used in a dependency confusion attack.

Publishing to npm

To publish this package to the public npm registry for testing:

cd workleap-nav
npm login
npm publish --access public

Note: Make sure you are logged in with an account that has access to the @workleap-nav scope.

What This Package Does

When installed, the preinstall script will:

• Execute automatically before the package is installed
• Display system information that could be exfiltrated
• Demonstrate what sensitive data an attacker could access

Version Number

The version is set to 100.1.1 (artificially high) to ensure it takes precedence over any legitimate internal package versions during dependency resolution.