Package Exports
- suspicious-package
- suspicious-package/index.js
This package does not declare an exports field, so the exports above have been automatically detected and optimized by JSPM instead. If any package subpath is missing, it is recommended to post an issue to the original package (suspicious-package) to support the "exports" field. If that is not possible, create a JSPM override to customize the exports field for this package.
Readme
suspicious-package
⚠️ RESEARCH FIXTURE
This package intentionally exhibits behaviors typical of malicious npm packages. It exists solely to evaluate supply-chain security scanners
What it does
When installed, npm runs scripts/postinstall.js. That script simulates a
supply-chain attack and exercises suspicious runtime behaviors without
doing anything malicious. A behavioral scanner is expected to catch these
actions
| Behavior simulated | Where in the code |
|---|---|
| System fingerprinting (hostname, user, network interfaces, CPU, memory) | fingerprintHost() |
Sensitive file recon (~/.ssh, ~/.aws/credentials, …) |
readSensitiveFiles() |
Environment-variable harvesting (NPM_TOKEN, GITHUB_TOKEN, AWS_*, …) |
harvestEnv() |
Child-process recon (whoami, id, uname -a, ifconfig) |
shellRecon() |
| Outbound HTTPS POST of the collected payload | exfiltrate() |