{"_id":"@always-further/npm-install-scripts-sim","name":"@always-further/npm-install-scripts-sim","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@always-further/npm-install-scripts-sim","version":"0.1.0","description":"Harmless npm lifecycle script simulator for Runseal supply-chain demos","license":"Apache-2.0","private":false,"publishConfig":{"access":"public"},"type":"commonjs","main":"index.js","scripts":{"preinstall":"node scripts/lifecycle.js preinstall","postinstall":"node scripts/lifecycle.js postinstall","test":"node scripts/lifecycle.js test"},"keywords":["runseal","supply-chain","npm","postinstall","simulation"],"engines":{"node":">=18"},"gitHead":"953f47014c74204f03f404b325420e033223505c","_id":"@always-further/npm-install-scripts-sim@0.1.0","_nodeVersion":"24.13.0","_npmVersion":"11.6.2","dist":{"integrity":"sha512-0l4b9rQ1k4CaSu5Z3ur9ZYJ3AQyRkzafUH6nt7/heJfFUmZLiWCU1nsmVeoyqSBkRbREMI03ibQWxY1SXeJKVQ==","shasum":"634337373f002c7db9cc59a1a710a0e745efd4fa","tarball":"https://registry.npmjs.org/@always-further/npm-install-scripts-sim/-/npm-install-scripts-sim-0.1.0.tgz","fileCount":4,"unpackedSize":5626,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIGex6+8VP2y+pWOMrwG64Zvd/cXfh2oPY2Ic43HDSLAIAiEAxpAJ45Rd3ei3milYfKpLhrXsOZyc5/ZS5PvnJAF+h4c="}]},"_npmUser":{"name":"lukehinds","email":"lhinds@protonmail.com"},"directories":{},"maintainers":[{"name":"lukehinds","email":"lhinds@protonmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/npm-install-scripts-sim_0.1.0_1779723019791_0.8461491441890638"},"_hasShrinkwrap":false}},"time":{"created":"2026-05-25T15:30:19.600Z","0.1.0":"2026-05-25T15:30:19.947Z","modified":"2026-05-25T15:30:20.160Z"},"maintainers":[{"name":"lukehinds","email":"lhinds@protonmail.com"}],"description":"Harmless npm lifecycle script simulator for Runseal supply-chain demos","keywords":["runseal","supply-chain","npm","postinstall","simulation"],"license":"Apache-2.0","readme":"# @always-further/npm-install-scripts-sim\n\nThis is a harmless npm package for Runseal supply-chain examples. It has\n`preinstall` and `postinstall` lifecycle scripts that simulate the behavior we\nwant to defend against: package install code attempting to POST metadata to an\nexternal API.\n\nThe package does **not** read secrets, tokens, SSH keys, source files, or git\nconfiguration. It sends only benign runtime metadata such as the lifecycle event\nname, package name, Node version, platform, architecture, hostname, and current\ndirectory basename.\n\n## Lifecycle Scripts\n\n```json\n{\n  \"scripts\": {\n    \"preinstall\": \"node scripts/lifecycle.js preinstall\",\n    \"postinstall\": \"node scripts/lifecycle.js postinstall\"\n  }\n}\n```\n\nBy default the scripts try to POST to:\n\n```text\nhttps://example.com/runseal/supply-chain-sim/npm-install-script\n```\n\nOverride the target with:\n\n```bash\nSUPPLY_CHAIN_SIM_ENDPOINT=http://127.0.0.1:18081/npm-install-script\n```\n\nBy default network failures are logged but do not fail installation. To make a\nblocked network attempt fail the install step, set:\n\n```bash\nSUPPLY_CHAIN_SIM_FAIL_ON_ERROR=1\n```\n\nTo disable the simulator:\n\n```bash\nSUPPLY_CHAIN_SIM_DISABLE=1\n```\n\n## Local Use\n\nFrom a separate test project:\n\n```bash\nnpm install /path/to/supply-chain-sims/npm-install-scripts\n```\n\nOr, after publishing:\n\n```bash\nnpm install @always-further/npm-install-scripts-sim\n```\n\nTo force lifecycle network failures to fail the install:\n\n```bash\nSUPPLY_CHAIN_SIM_FAIL_ON_ERROR=1 \\\nnpm install @always-further/npm-install-scripts-sim\n```\n\n## Publishing\n\n```bash\nnpm whoami\nnpm publish --access public\n```\n\n## Runseal Demo Use\n\nThis fixture is useful for showing the difference between:\n\n```bash\nnpm ci --ignore-scripts\n```\n\nand:\n\n```bash\nnpm rebuild\n```\n\nwith `network.mode: blocked`.\n\nThe expected Runseal result is that lifecycle scripts can run if explicitly\nneeded, but their network attempt is denied by the sandbox.\n","readmeFilename":"README.md","_rev":"1-71fd97db6ec38611c2ea7402f452870d"}