supply-chain-canary

Inert test fixture for validating supply chain attack detection systems.

What This Does

This package mimics the code patterns found in real supply chain attacks without performing any harmful operations.

Detection Signatures Present

| Pattern | File | Behavior | |---------|------|----------| | child_process.execSync in install hook | preinstall.js, postinstall.js | Writes canary file to /tmp | | Environment fingerprinting (os.userInfo, os.hostname) | preinstall.js | Collected but only written to local file | | net.Socket + spawn('/bin/sh') (reverse shell) | postinstall.js | Dead code (if (false)) | | Base64 encoded string execution | postinstall.js | Dead code | | Obfuscated variable names (_0x1a) | preinstall.js | Joins to string "canary", logged to console | | curl | sh download-and-execute | postinstall.js | Dead code |

Actual Side Effects

• Writes /tmp/supply_chain_canary_preinstall.json
• Writes /tmp/supply-chain-canary/postinstall.triggered
• Appends to /tmp/canary.log
• Console output with [supply-chain-canary] prefix

Usage

# Test your detection tooling against this package
npm install ./supply-chain-canary

# Verify canary fired
cat /tmp/canary.log
cat /tmp/supply-chain-canary/postinstall.triggered

# Clean up
rm -rf /tmp/supply-chain-canary /tmp/supply_chain_canary_preinstall.json /tmp/canary.log

What Your Detection Should Flag

A good supply chain scanner should flag:

1. preinstall / postinstall scripts in package.json
2. child_process usage in lifecycle scripts
3. net.Socket connection patterns
4. spawn('/bin/sh') invocations
5. Base64-encoded strings passed to exec
6. Environment info collection (os.userInfo, os.hostname)
7. Obfuscated variable naming patterns