jfrog-curation-canary 1.0.20260821

package/.github/workflows/canary-publish.yml

@@ -0,0 +1,40 @@
+name: Publish daily canary
+
+on:
+  schedule:
+    # 05:00 UTC daily
+    - cron: '0 5 * * *'
+  workflow_dispatch: {}
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Compute today's version
+        id: version
+        run: echo "version=1.0.$(date -u +%Y%m%d)" >> "$GITHUB_OUTPUT"
+
+      - name: Set package version
+        run: npm pkg set version="${{ steps.version.outputs.version }}"
+
+      - name: Skip if already published today
+        id: check
+        run: |
+          if npm view "jfrog-curation-canary@${{ steps.version.outputs.version }}" version --registry https://registry.npmjs.org >/dev/null 2>&1; then
+            echo "already_published=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "already_published=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish
+        if: steps.check.outputs.already_published == 'false'
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dylan Mo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,32 @@
+# jfrog-curation-canary
+
+A deliberately harmless npm package, published automatically to the public npm
+registry once a day at 05:00 UTC by [`.github/workflows/canary-publish.yml`](.github/workflows/canary-publish.yml)
+in this repo.
+
+## Why does this exist?
+
+It's a demo fixture for **JFrog Curation's Immature Package Policy** — a policy
+that blocks any package newer than N days old, regardless of whether it's
+actually malicious. Most supply-chain attacks (e.g. the 2025 Shai-Hulud npm
+worm) exploit the gap between when a malicious package is published and when
+threat intelligence catches up to flag it. A policy that blocks anything "too
+new" closes that gap without needing to know anything about the package's
+actual content.
+
+Because this package is republished daily, its latest version is always
+guaranteed to be less than 24 hours old — which makes it a reliable, real,
+live target for demonstrating that block, on demand, without needing to wait
+for a real (and possibly actually malicious) package to show up.
+
+## What does it do?
+
+Nothing. `require`-ing or running it prints a one-line message and exits. See
+[`index.js`](index.js).
+
+## Who maintains this?
+
+[Dylan Mo](https://github.com/dylanmo-jfrog), a JFrog Solutions Engineer, for
+use in JFrog Curation product demos. Not an official JFrog product or
+package. If you found this while investigating a dependency and have
+questions about it, feel free to open an issue.

package/index.js

@@ -0,0 +1,2 @@
+console.log("Hello from jfrog-curation-canary! This package is intentionally harmless.");
+console.log("It exists solely to demo JFrog Curation's Immature Package Policy.");

package/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "jfrog-curation-canary",
+  "version": "1.0.20260821",
+  "description": "A harmless, auto-published-daily npm package used to demo JFrog Curation's Immature Package Policy (blocks any package newer than N days, regardless of threat intelligence).",
+  "main": "index.js",
+  "scripts": {
+    "start": "node index.js"
+  },
+  "author": "Dylan Mo <dylanmo@jfrog.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dylanmo-jfrog/jfrog-curation-canary.git"
+  },
+  "keywords": [
+    "jfrog",
+    "curation",
+    "demo",
+    "canary"
+  ]
+}