suspicious-package

⚠️ RESEARCH FIXTURE

This package intentionally exhibits behaviors typical of malicious npm packages. It exists solely to evaluate supply-chain security scanners

What it does

When installed, npm runs scripts/postinstall.js. That script simulates a supply-chain attack and exercises suspicious runtime behaviors without doing anything malicious. A behavioral scanner is expected to catch these actions

Behavior simulated	Where in the code
System fingerprinting (hostname, user, network interfaces, CPU, memory)	fingerprintHost()
Sensitive file recon (~/.ssh, ~/.aws/credentials, …)	readSensitiveFiles()
Environment-variable harvesting (NPM_TOKEN, GITHUB_TOKEN, AWS_*, …)	harvestEnv()
Child-process recon (whoami, id, uname -a, ifconfig)	shellRecon()
Outbound HTTPS POST of the collected payload	exfiltrate()