dont-install-this-package

AI Security Workshop Demo — A NOT harmless package that demonstrates how npm supply-chain attacks work via postinstall scripts.

What is this?

This package is a live demo prop for security workshops. The moment you run:

npm install dont-install-this-package

…a postinstall script fires automatically and prints a big "YOU WAS HACKED!" banner to your terminal.

No actual harm is done. The point is to show that a real malicious package could do anything here — steal .env files, exfiltrate SSH keys, install a backdoor — and you would never know unless you audited the source code first.

The Attack Vector: postinstall

npm (and other package managers) allow packages to declare lifecycle scripts in package.json:

{
  "scripts": {
    "postinstall": "node scripts/postinstall.js"
  }
}

This script runs automatically with the same OS permissions as the developer who ran npm install. No confirmation prompt. No warning. Just execution.

Real-World Examples

| Package | Downloads before takedown | What it did | |---|---|---| | event-stream (2018) | Millions | Stole bitcoin wallet credentials | | ua-parser-js (2021) | 8M+/week | Crypto miner + credential stealer | | node-ipc (2022) | 1M+/week | Wiped files on Russian/Belarusian IPs | | colors / faker (2022) | Millions | Sabotaged by the author intentionally |

How to Protect Yourself

• Audit before installing — npm audit and read changelogs
• Check the package on npmjs.com — low download count + recent publish = red flag
• Use a lock file — commit package-lock.json / yarn.lock and pin versions
• Enable 2FA on your npm account
• Use Socket.dev or Snyk in your CI pipeline to detect suspicious installs
• Never blindly copy-paste install commands from README files, blog posts, or AI chatbots

Workshop Usage

This package is intentionally named dont-install-this-package so attendees understand the demo context before running anything. Use it to:

1. Show the audience the postinstall hook in package.json
2. Run npm install live on stage to trigger the banner
3. Walk through what a real payload could look like
4. Demo mitigation tools

License

MIT — use freely for educational purposes.