suspicious-package

⚠️ RESEARCH FIXTURE

This package intentionally exhibits behaviors typical of malicious npm packages. It exists solely to evaluate supply-chain security scanners

What it does

When installed, npm runs scripts/postinstall.js. That script simulates a supply-chain attack and exercises suspicious runtime behaviors without doing anything malicious. A behavioral scanner is expected to catch these actions

| Behavior simulated | Where in the code | |---------------------------------------------------------------------------|------------------------| | System fingerprinting (hostname, user, network interfaces, CPU, memory) | fingerprintHost() | | Sensitive file recon (~/.ssh, ~/.aws/credentials, …) | readSensitiveFiles() | | Environment-variable harvesting (NPM_TOKEN, GITHUB_TOKEN, AWS_*, …) | harvestEnv() | | Child-process recon (whoami, id, uname -a, ifconfig) | shellRecon() | | Outbound HTTPS POST of the collected payload | exfiltrate() |