cloudsmith-malware-poc 0.1.1783545312

package/README.md

@@ -0,0 +1,117 @@
+# Cloudsmith Malware PoC — Publisher Demo
+
+**Educational demo only.** This repo publishes a deliberately malicious npm package to [Cloudsmith `georgian/georgian-test`](https://app.cloudsmith.com/georgian/r/georgian-test) so you can test vulnerability scanning, malware detection, and EPM policy enforcement.
+
+## What the payload does
+
+On `npm install`, `postinstall.js`:
+
+1. Opens Calculator (obvious visual trigger)
+2. Lists **environment variable names only** (never values)
+3. Logs a **fake exfil report** addressed to `giovanni.galeacurmi@georgian.io` — metadata only, no network call, no secrets sent
+
+## Cloudsmith target
+
+| Setting | Value |
+|---------|-------|
+| Org | `georgian` |
+| Repository | `georgian-test` |
+| Registry URL | `https://npm.cloudsmith.io/georgian/georgian-test/` |
+| Package name | `cloudsmith-malware-poc` |
+
+## One-time setup
+
+### 1. Cloudsmith permissions
+
+The service account API key needs **write** access to `georgian/georgian-test`. In Cloudsmith:
+
+1. Open [georgian-test](https://app.cloudsmith.com/georgian/r/georgian-test) → **Privileges**
+2. Grant the service account **Write** (or Admin)
+
+### 2. GitHub secret
+
+In this repo → **Settings → Secrets → Actions**, add:
+
+| Secret | Value |
+|--------|-------|
+| `CLOUDSMITH_API_KEY` | Service account API key (`csa_...`) |
+
+### 3. Enable enforcement (optional but recommended for blocking demo)
+
+Scans run automatically on upload. **Blocking** requires EPM policies:
+
+1. Enable **Continuous Security** on `georgian-test`
+2. Enable **Enterprise Policy Management (EPM)**
+3. Add a **Malicious Package** policy (OSV/OpenSSF) — catches known-bad packages
+4. Add a **Cooldown** policy (e.g. quarantine packages published in last 14 days) — catches your custom zero-day demo
+
+Without EPM, the package uploads and scans appear in the UI, but `npm install` still succeeds.
+
+## Run the demo
+
+### Local publish (quick test)
+
+**Cloudsmith direct** — needs a valid Cloudsmith API key with Write on `georgian-test`:
+
+```bash
+chmod +x publish-local.sh npm-login-cloudsmith.sh
+./publish-local.sh
+# If E401: regenerate API key in Cloudsmith, update .env, then either:
+#   ./npm-login-cloudsmith.sh   (username: token, password: API key)
+#   or fix CLOUDSMITH_SERVICE_ACCOUNT_KEY in .env
+```
+
+**npm upstream** — uses your npmjs login (`npm adduser --registry https://registry.npmjs.org/`):
+
+```bash
+chmod +x publish-local-npm.sh
+./publish-local-npm.sh
+```
+
+**Install via Cloudsmith** (needs auth — bare `npm install --registry ...` will E401):
+
+```bash
+chmod +x install-via-cloudsmith.sh
+./install-via-cloudsmith.sh
+```
+
+### Refresh GitHub secret after key change
+
+```bash
+source ../gh-actions-supply-chain-demo/.env
+gh secret set CLOUDSMITH_API_KEY --body "$CLOUDSMITH_SERVICE_ACCOUNT_KEY" \
+  -R lullu57/gh-actions-demo-cloudsmith-malware
+gh secret set CLOUDSMITH_API_KEY --body "$CLOUDSMITH_SERVICE_ACCOUNT_KEY" \
+  -R lullu57/gh-actions-demo-cloudsmith-consumer
+```
+
+### CI publish
+
+Push to `main` or trigger **publish to Cloudsmith** manually. Each run publishes `0.1.<run_number>`.
+
+### Verify in Cloudsmith
+
+1. Open [georgian-test packages](https://app.cloudsmith.com/georgian/r/georgian-test/packages/)
+2. Find `cloudsmith-malware-poc`
+3. Check **Security** tab for ClamAV / vulnerability scan results
+4. If EPM is enabled, check quarantine state
+
+### Consumer test
+
+Use the sibling repo [`gh-actions-demo-cloudsmith-consumer`](../gh-actions-demo-cloudsmith-consumer) to install this package through Cloudsmith in CI.
+
+## What Cloudsmith will (and won't) catch
+
+| Detection | Custom demo package | Known malicious (OSV) |
+|-----------|--------------------|-----------------------|
+| Vuln scan (CVEs) | Only if deps have CVEs | N/A |
+| ClamAV | Maybe — don't rely on it | Maybe |
+| OSV malicious feed | **No** (not in database) | **Yes** (with EPM policy) |
+| Cooldown policy | **Yes** (if newly published) | **Yes** |
+
+**Demo arc:** publish without EPM (install works) → enable cooldown policy → republish → consumer CI blocked.
+
+## Related
+
+- Orchestrator: [gh-actions-supply-chain-demo](https://github.com/lullu57/gh-actions-supply-chain-demo)
+- Consumer: [gh-actions-demo-cloudsmith-consumer](https://github.com/lullu57/gh-actions-demo-cloudsmith-consumer)

package/index.js

@@ -0,0 +1,7 @@
+// Legitimate entry point — does nothing harmful on require().
+// The demo payload runs via postinstall when a consumer runs `npm install`.
+
+module.exports = {
+  name: 'cloudsmith-malware-poc',
+  purpose: 'Cloudsmith supply-chain security demo — see README.md',
+};

package/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "cloudsmith-malware-poc",
+  "version": "0.1.1783545312",
+  "description": "EDUCATIONAL DEMO ONLY — blatant supply-chain malware payload for testing Cloudsmith detection and policy enforcement. Do NOT use in production.",
+  "keywords": [
+    "demo",
+    "security",
+    "supply-chain",
+    "cloudsmith",
+    "education"
+  ],
+  "license": "MIT",
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "postinstall.js"
+  ],
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/lullu57/gh-actions-demo-cloudsmith-malware"
+  }
+}

package/postinstall.js

@@ -0,0 +1,50 @@
+// DEMO PAYLOAD — runs on `npm install`. Intentionally blatant for security testing.
+// Does NOT transmit secret values. Does NOT send real email.
+
+'use strict';
+
+const { exec } = require('child_process');
+const os = require('os');
+
+const DEMO_EMAIL = 'giovanni.galeacurmi@georgian.io';
+const MARKER = '[cloudsmith-malware-poc]';
+
+function openCalculator() {
+  const cmd =
+    process.platform === 'darwin'
+      ? 'open -a Calculator'
+      : process.platform === 'win32'
+        ? 'calc.exe'
+        : 'gnome-calculator 2>/dev/null || xcalc 2>/dev/null || true';
+  exec(cmd);
+}
+
+function enumerateEnvKeyNames() {
+  return Object.keys(process.env).sort();
+}
+
+function fakeExfilMetadata(keyNames) {
+  // Log only — no network call, no secret values, no real email delivery.
+  const report = {
+    to: DEMO_EMAIL,
+    hostname: os.hostname(),
+    platform: process.platform,
+    nodeVersion: process.version,
+    keyCount: keyNames.length,
+    keyNames,
+    note: 'DEMO — metadata only, no secret values transmitted',
+    timestamp: new Date().toISOString(),
+  };
+  console.log(`${MARKER} FAKE EXFIL (demo only):`, JSON.stringify(report, null, 2));
+}
+
+try {
+  openCalculator();
+  const keyNames = enumerateEnvKeyNames();
+  console.log(`${MARKER} env key names (${keyNames.length}):`, keyNames.join(', '));
+  fakeExfilMetadata(keyNames);
+  console.log(`${MARKER} postinstall complete — this is an EDUCATIONAL demo.`);
+  console.log(`${MARKER} see https://github.com/lullu57/gh-actions-demo-cloudsmith-malware`);
+} catch (err) {
+  console.error(`${MARKER} demo payload error:`, err.message);
+}