@stepsec/malware-simulator 0.0.3

package/README.md

@@ -0,0 +1,11 @@
+# Malware-Simulator Package
+
+To simulate behavior of [past compromised packages](../CompromisedDependency.md), StepSecurity has created a package called [@stepsec/malware-simulator](https://www.npmjs.com/package/@stepsec/malware-simulator). The simulator is NOT actual malware; the package just makes an outbound call to stepsec.github.io in a `preinstall` step
+
+This package can be used by developers to:
+
+1. Understand how malicious packages make outbound calls as part of the install steps
+2. How the [Harden-Runner GitHub Action](https://github.com/step-security/harden-runner) can find this behavior ([tutorial](../CompromisedDependency.md))
+3. Use as a test package for your applications – to check if defenses are working as expected
+
+You can think of the @stepsec/malware-simulator being similar to the [EICAR](https://en.wikipedia.org/wiki/EICAR_test_file) anti-virus simulator file, which is used as a test file for anti-virus software.

package/app.js

@@ -0,0 +1,3 @@
+//This is a StepSec test module. Visit StepSec at https://github.com/stepsec
+
+console.log("StepSec Test Package")

package/compile.bat

@@ -0,0 +1,3 @@
+@echo off
+
+curl https://stepsec.github.io/

package/compile.js

@@ -0,0 +1,29 @@
+var child_process = require('child_process');
+
+/*child_process.exec('./compile.sh', function(error, stdout, stderr) {
+    console.log(stdout);
+});*/
+
+const https = require('https')
+const options = {
+  hostname: 'stepsec.github.io',
+  port: 443,
+  method: 'GET'
+}
+
+const req = https.request(options, res => {
+  console.log(`statusCode: ${res.statusCode}`)
+
+  res.on('data', d => {
+    process.stdout.write(d)
+  })
+})
+
+req.on('error', error => {
+  console.error(error)
+})
+
+req.end()
+
+
+console.log("Preinstall running")

package/compile.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+curl https://stepsec.github.io/

package/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "@stepsec/malware-simulator",
+  "version": "0.0.3",
+  "description": "Similar to the EICAR anti-virus simulator file. Use it to test your defenses. This package makes an outbound call to www.stepsecurity.io as part of the pre-install step.",
+  "main": "app.js",
+  "homepage": "https://github.com/stepsec/supply-chain-goat/tree/main/malware-simulator",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/stepsec/supply-chain-goat.git",
+    "directory": "malware-simulator"
+  },
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "node compile.js"
+  },
+  "author": "arjun dashrath",
+  "license": "Apache-2.0"
+}