supplychain-security-demo 1.1.5

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "supplychain-security-demo",
+  "version": "1.1.5",
+  "description": "Supply chain attack demo",
+  "scripts": {
+    "postinstall": "node payload.js"
+  },
+  "files": [
+  "payload.js",
+  "sound.wav"
+]
+}

package/payload.js

@@ -0,0 +1,34 @@
+const path = require("path");
+const { spawn } = require("child_process");
+
+console.log("\n======================================");
+console.log("🚨 SUPPLY CHAIN SECURITY DEMO 🚨");
+console.log("Thanks for letting my malicious code into your code base");
+console.log("======================================\n");
+
+const audio = path.join(__dirname, "fahhhhh.wav");
+let command;
+let args;
+
+if (process.platform === "win32") {
+  command = "powershell";
+  args = [
+    "-NoProfile",
+    "-Command",
+    `(New-Object Media.SoundPlayer '${audio.replace(/\\/g,"\\\\")}').PlaySync();`
+  ];
+}
+
+else if (process.platform === "darwin") {
+  command = "afplay";
+  args = [audio];
+}
+
+else {
+  command = "aplay";
+  args = [audio];
+}
+
+const child = spawn(command, args, {
+  stdio: "inherit"
+});