@selfpentest/eslint-pentest-plugin 1.0.0 → 1.0.2

package/DISCLOSURE

@@ -0,0 +1,5 @@
+The package may appear as a hacking tool of malware, but it is neither.
+
+It is only useful for educational purposes.
+
+There is no way to reasonably use it for actual penetration testing, it demonstrates a supply-chain security concept for educational purposes and deliberately hardcodes a choice of useless values as demonstration data to send to a hardcoded localhost url. 

package/README.md

@@ -11,6 +11,8 @@ Install it and specify its use in eslint configuration to see how it can be used
 
 The plugin will demonstrate exfiltrating environment variables and the first 30 characters of `.ssh/known_hosts` to a server listening on `http://localhost:1337/`
 
+Use `npx @selfpentest/demo-cc` to run the local HTTP server that will receive and display the demonstration payload.
+
 ## modern flat config
 
 `eslint.config.js`:
@@ -37,4 +39,6 @@ ESLint reads the plugin name string, resolves it from `node_modules`, and `requi
 
 ## Intent
 
-This package is not a hacking tool. It lets the developer check if their setup is vulnerable and can be used for security demonstrations.
+This package is not a hacking tool. It lets the developer learn about a potential supply chain security issue.
+
+It serves as a test case for educational purposes and practicing preventing supply chain attacks in a controlled environment.

package/package.json

@@ -1,14 +1,17 @@
 {
   "name": "@selfpentest/eslint-pentest-plugin",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "main": "index.js",
   "publishConfig": {
     "access": "public"
   },
+  "contentPolicy": {
+    "class": "dual-use"
+  },
   "scripts": {
     "test": "echo boop"
   },
   "author": "selfpentest",
   "license": "MIT",
-  "description": "An example package for training oneself that pretends to be an eslint plugin but it steals secrets instead"
+  "description": "An example package for training oneself that is an eslint plugin but it pretends to exfiltrate information"
 }