{"_id":"@damnvulnerablewebsite/interpreter-py","_rev":"4-fbde18ddaf38054dde42b5f9266e1692","name":"@damnvulnerablewebsite/interpreter-py","dist-tags":{"latest":"1.0.5"},"versions":{"1.0.0":{"name":"@damnvulnerablewebsite/interpreter-py","version":"1.0.0","keywords":["python","interpreter","vulnerable","security","testing"],"author":{"name":"Shanyu Thibaut Juneja"},"license":"ISC","_id":"@damnvulnerablewebsite/interpreter-py@1.0.0","maintainers":[{"name":"terminalsin","email":"shanyujuneja@gmail.com"}],"dist":{"shasum":"e12930373a9d007ee500533ee321068f9fa4e757","tarball":"https://registry.npmjs.org/@damnvulnerablewebsite/interpreter-py/-/interpreter-py-1.0.0.tgz","fileCount":18,"integrity":"sha512-uOgo7FZT+qVGXEH9w8atLcOYPE0nD3oJIxdLX42iXfXQUxwAG86WD6HcK1uKJPxIdckapzXS16Z57Ph6Lk26xg==","signatures":[{"sig":"MEQCICov4OwR//VgKvtNMvhHNxfsaawTLpGga8boZ49SaXqqAiBGgIBAo3PMLK/Pkjt9Cz47qTozTsyf5S9q8lFBaoVikg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":66056},"main":"dist/index.js","types":"dist/index.d.ts","gitHead":"2226396d1aa9d99f021ca0499ee6fa7be0f9bb04","scripts":{"dev":"nodemon --exec ts-node examples/basic-usage.ts","test":"jest","build":"tsc","clean":"rm -rf dist coverage","start":"node dist/index.js","test:ci":"jest --ci --coverage --watchAll=false","test:watch":"jest --watch","test:coverage":"jest --coverage"},"_npmUser":{"name":"terminalsin","email":"shanyujuneja@gmail.com"},"_npmVersion":"11.3.0","description":"This package is designed to prototype an interpreter library for python code importer in TypeScript that is designed to be vulnerable.","directories":{},"_nodeVersion":"24.1.0","_hasShrinkwrap":false,"devDependencies":{"jest":"^30.0.4","nodemon":"^3.1.9","ts-jest":"^29.4.0","ts-node":"^10.9.2","typescript":"^5.7.4","@types/jest":"^30.0.0","@types/node":"^22.10.7"},"_npmOperationalInternal":{"tmp":"tmp/interpreter-py_1.0.0_1752621899327_0.030184978187789868","host":"s3://npm-registry-packages-npm-production"}},"1.0.1":{"name":"@damnvulnerablewebsite/interpreter-py","version":"1.0.1","keywords":["python","interpreter","vulnerable","security","testing"],"author":{"name":"Shanyu Thibaut Juneja"},"license":"ISC","_id":"@damnvulnerablewebsite/interpreter-py@1.0.1","maintainers":[{"name":"terminalsin","email":"shanyujuneja@gmail.com"}],"dist":{"shasum":"337c9c541bfb4165f22a1bc4b7e152482f7284aa","tarball":"https://registry.npmjs.org/@damnvulnerablewebsite/interpreter-py/-/interpreter-py-1.0.1.tgz","fileCount":18,"integrity":"sha512-VsYWjHe1/WR144MGblHwLN2vUhHO77v9QcSp4rNk5D9AcGBiob5VE6vI3NDO6H4lkanCdmcLGK9Vd3mstNKY2g==","signatures":[{"sig":"MEUCIQDjniQuXZFYT6fDLE2D7DF9EoLeO6j1n/0ZqeueT2CAMAIgUXfpuZ4FToyZlGY+JsBsFAwNNG1SHdo7hg9URxjSOes=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":66323},"main":"dist/index.js","types":"dist/index.d.ts","gitHead":"4b8ea504f2642a288076e084590330ca4e4bf54d","scripts":{"dev":"nodemon --exec ts-node examples/basic-usage.ts","test":"jest","build":"tsc","clean":"rm -rf dist coverage","start":"node dist/index.js","test:ci":"jest --ci --coverage --watchAll=false","test:watch":"jest --watch","test:coverage":"jest --coverage"},"_npmUser":{"name":"terminalsin","email":"shanyujuneja@gmail.com"},"_npmVersion":"11.3.0","description":"This package is designed to prototype an interpreter library for python code importer in TypeScript that is designed to be vulnerable.","directories":{},"_nodeVersion":"24.1.0","_hasShrinkwrap":false,"devDependencies":{"jest":"^30.0.4","nodemon":"^3.1.9","ts-jest":"^29.4.0","ts-node":"^10.9.2","typescript":"^5.7.4","@types/jest":"^30.0.0","@types/node":"^22.10.7"},"_npmOperationalInternal":{"tmp":"tmp/interpreter-py_1.0.1_1752622365900_0.48813973426609425","host":"s3://npm-registry-packages-npm-production"}},"1.0.4":{"name":"@damnvulnerablewebsite/interpreter-py","version":"1.0.4","keywords":["python","interpreter","vulnerable","security","testing"],"author":{"name":"Shanyu Thibaut Juneja"},"license":"ISC","_id":"@damnvulnerablewebsite/interpreter-py@1.0.4","maintainers":[{"name":"terminalsin","email":"shanyujuneja@gmail.com"}],"homepage":"https://github.com/terminalsin/damnvulnerablewebsite-interpreter-py#readme","bugs":{"url":"https://github.com/terminalsin/damnvulnerablewebsite-interpreter-py/issues"},"dist":{"shasum":"4df98993b29afe7b9fe546d002e4c54fd2348c4f","tarball":"https://registry.npmjs.org/@damnvulnerablewebsite/interpreter-py/-/interpreter-py-1.0.4.tgz","fileCount":18,"integrity":"sha512-eePnm6811r3hXUejpp8E9xHdWw7WQ0xnEYJRzySohVEP/O387PNPGncu1ItS7oosHtiE98sFfLAq8qp4xv6rrQ==","signatures":[{"sig":"MEYCIQD/6Q3qToFi0EbkXfxNbQ4sE3enDcCcQqcaroaGxRMEiwIhAKMkSibP0jQ3eQxoYlksnT9nw0YEA7TKLcc6vV5VcVMP","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@damnvulnerablewebsite%2finterpreter-py@1.0.4","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":66646},"main":"dist/index.js","types":"dist/index.d.ts","gitHead":"8faf3cf0149346a2b24ee7e11ee09207da3cff25","scripts":{"dev":"nodemon --exec ts-node examples/basic-usage.ts","test":"jest","build":"tsc","clean":"rm -rf dist coverage","start":"node dist/index.js","test:ci":"jest --ci --coverage --watchAll=false","test:watch":"jest --watch","test:coverage":"jest --coverage"},"_npmUser":{"name":"terminalsin","email":"shanyujuneja@gmail.com"},"repository":{"url":"git+https://github.com/terminalsin/damnvulnerablewebsite-interpreter-py.git"},"_npmVersion":"10.8.2","description":"This package is designed to prototype an interpreter library for python code importer in TypeScript that is designed to be vulnerable.","directories":{},"_nodeVersion":"18.20.8","_hasShrinkwrap":false,"devDependencies":{"jest":"^30.0.4","nodemon":"^3.1.9","ts-jest":"^29.4.0","ts-node":"^10.9.2","typescript":"^5.7.4","@types/jest":"^30.0.0","@types/node":"^22.10.7"},"_npmOperationalInternal":{"tmp":"tmp/interpreter-py_1.0.4_1752623419994_0.3154991744534985","host":"s3://npm-registry-packages-npm-production"}},"1.0.5":{"name":"@damnvulnerablewebsite/interpreter-py","version":"1.0.5","description":"This package is designed to prototype an interpreter library for python code importer in TypeScript that is designed to be vulnerable.","repository":{"url":"git+https://github.com/terminalsin/damnvulnerablewebsite-interpreter-py.git"},"main":"dist/index.js","types":"dist/index.d.ts","scripts":{"build":"tsc","dev":"nodemon --exec ts-node examples/basic-usage.ts","start":"node dist/index.js","test":"jest","test:watch":"jest --watch","test:coverage":"jest --coverage","test:ci":"jest --ci --coverage --watchAll=false","clean":"rm -rf dist coverage"},"keywords":["python","interpreter","vulnerable","security","testing"],"author":{"name":"Shanyu Thibaut Juneja"},"license":"ISC","devDependencies":{"@types/jest":"^30.0.0","@types/node":"^22.10.7","jest":"^30.0.4","nodemon":"^3.1.9","ts-jest":"^29.4.0","ts-node":"^10.9.2","typescript":"^5.7.4"},"_id":"@damnvulnerablewebsite/interpreter-py@1.0.5","gitHead":"797c1e09042f0730c32994d9c88acd66fc2f728d","bugs":{"url":"https://github.com/terminalsin/damnvulnerablewebsite-interpreter-py/issues"},"homepage":"https://github.com/terminalsin/damnvulnerablewebsite-interpreter-py#readme","_nodeVersion":"18.20.8","_npmVersion":"10.8.2","dist":{"integrity":"sha512-kiamIn3eVh2qBdwNexgAE7X7IBdgmUSm/KrqDK4IX+6dM4uJIak/XyKcIWtnqYA9VfczAbdcdYdsQxtw1ImXFw==","shasum":"46d630e8747020447674490bd447dba369702db7","tarball":"https://registry.npmjs.org/@damnvulnerablewebsite/interpreter-py/-/interpreter-py-1.0.5.tgz","fileCount":18,"unpackedSize":65323,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@damnvulnerablewebsite%2finterpreter-py@1.0.5","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQCvZ6WkJG4TMB0/A7RnOfITZcc1kbkkvFLusMacCBm+7wIgb0KYbMxRrs1vaKv20fl4MB4zPXRF6TXkDHcpK/wbF0M="}]},"_npmUser":{"name":"terminalsin","email":"shanyujuneja@gmail.com"},"directories":{},"maintainers":[{"name":"terminalsin","email":"shanyujuneja@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/interpreter-py_1.0.5_1752624010214_0.687043275203681"},"_hasShrinkwrap":false}},"time":{"created":"2025-07-15T23:24:59.205Z","modified":"2025-07-16T00:00:10.767Z","1.0.0":"2025-07-15T23:24:59.508Z","1.0.1":"2025-07-15T23:32:46.069Z","1.0.4":"2025-07-15T23:50:20.199Z","1.0.5":"2025-07-16T00:00:10.392Z"},"bugs":{"url":"https://github.com/terminalsin/damnvulnerablewebsite-interpreter-py/issues"},"author":{"name":"Shanyu Thibaut Juneja"},"license":"ISC","homepage":"https://github.com/terminalsin/damnvulnerablewebsite-interpreter-py#readme","keywords":["python","interpreter","vulnerable","security","testing"],"repository":{"url":"git+https://github.com/terminalsin/damnvulnerablewebsite-interpreter-py.git"},"description":"This package is designed to prototype an interpreter library for python code importer in TypeScript that is designed to be vulnerable.","maintainers":[{"name":"terminalsin","email":"shanyujuneja@gmail.com"}],"readme":"\n\n<!-- TOC --><a name=\"damnvulnerableinterpreter-py\"></a>\n\n<!-- TOC start (generated with https://github.com/derlin/bitdowntoc) -->\n<div style=\"display: flex; align-items: center; gap: 15px;\">\n<img src=\"https://raw.githubusercontent.com/terminalsin/damnvulnerablewebsite-interpreter-py/refs/heads/master/.docs/icon.png\" width=\"100px\">\n<div>\n<h1 style=\"margin: 0;\"> \nDamnVulnerableWebsite - Python Interpreter </h1>\n\n<img alt=\"NPM License\" src=\"https://img.shields.io/npm/l/%40damnvulnerablewebsite%2Finterpreter-py?style=flat-square\">\n<img alt=\"NPM Version\" src=\"https://img.shields.io/npm/v/%40damnvulnerablewebsite%2Finterpreter-py?style=flat-square\">\n</div>\n</div>\n<br/>\n\nA deliberately vulnerable Python code interpreter library for TypeScript, designed for **educational and security testing purposes**.\n\n<br/>\n\n> [!CAUTION]\n>  ⚠️ SECURITY WARNING\n> **🚨 THIS PACKAGE CONTAINS INTENTIONAL VULNERABILITIES FOR EDUCATIONAL PURPOSES ONLY!**\n> **DO NOT USE IN PRODUCTION ENVIRONMENTS!**\n> This package is designed to demonstrate common security vulnerabilities in code interpretation systems. \n\n<br/>\n\n- [🚀 Installation](#-installation)\n  - [Prerequisites](#prerequisites)\n- [📖 Quick Start](#-quick-start)\n  - [Basic Usage](#basic-usage)\n  - [Streaming Output](#streaming-output)\n  - [Educational Vulnerability Demonstration](#educational-vulnerability-demonstration)\n- [🛠️ API Reference](#️-api-reference)\n  - [Classes](#classes)\n    - [`PythonInterpreter`](#pythoninterpreter)\n    - [`PythonLinter`](#pythonlinter)\n  - [Utility Functions](#utility-functions)\n    - [`createInterpreter(config?)`](#createinterpreterconfig)\n    - [`createUnsafeInterpreter(config?)`](#createunsafeinterpreterconfig)\n    - [`createQuickInterpreter(preset, config?)`](#createquickinterpreterpreset-config)\n    - [`checkPythonAvailability(pythonPath?)`](#checkpythonavailabilitypythonpath)\n  - [Configuration Options](#configuration-options)\n  - [Execution Options](#execution-options)\n- [🎯 Examples](#-examples)\n- [🔒 Security Vulnerabilities (Educational)](#-security-vulnerabilities-educational)\n  - [1. Command Injection](#1-command-injection)\n  - [2. Arbitrary Code Execution](#2-arbitrary-code-execution)\n  - [3. File System Access](#3-file-system-access)\n  - [4. Input Sanitization Bypass](#4-input-sanitization-bypass)\n  - [5. Information Disclosure](#5-information-disclosure)\n  - [6. Resource Exhaustion](#6-resource-exhaustion)\n- [🧪 Testing](#-testing)\n- [📜 Scripts](#-scripts)\n- [📄 License](#-license)\n- [⚖️ Legal Disclaimer](#️-legal-disclaimer)\n- [🔗 Inspired from](#-inspired-from)\n\n<!-- TOC end -->\n\n\n\n\n\n<!-- TOC --><a name=\"-installation\"></a>\n## 🚀 Installation\n\n```bash\nnpm install @damnvulnerablewebsite/interpreter-py\n```\n\n<!-- TOC --><a name=\"prerequisites\"></a>\n### Prerequisites\n\n- Node.js 18 or higher\n- Python 3.x installed and accessible in PATH\n- TypeScript (if using TypeScript)\n\n<!-- TOC --><a name=\"-quick-start\"></a>\n## 📖 Quick Start\n\n<!-- TOC --><a name=\"basic-usage\"></a>\n### Basic Usage\n\n```typescript\nimport { createInterpreter } from '@damnvulnerablewebsite/interpreter-py';\n\nasync function example() {\n  const interpreter = createInterpreter();\n  \n  const result = await interpreter.executeCode(`\n    print(\"Hello from Python!\")\n    import math\n    print(f\"Pi is approximately {math.pi}\")\n  `);\n  \n  console.log('Output:', result.stdout);\n  console.log('Success:', result.success);\n}\n```\n\n<!-- TOC --><a name=\"streaming-output\"></a>\n### Streaming Output\n\n```typescript\nimport { createQuickInterpreter } from '@damnvulnerablewebsite/interpreter-py';\n\nconst interpreter = createQuickInterpreter('testing');\n\ninterpreter.on('data', (output) => {\n  console.log(`[${output.type}]`, output.data);\n});\n\ninterpreter.on('complete', (result) => {\n  console.log('Execution completed:', result.success);\n});\n\nawait interpreter.executeCode(`\nimport time\nfor i in range(3):\n    print(f\"Step {i + 1}\")\n    time.sleep(1)\n`, { stream: true });\n```\n\n<!-- TOC --><a name=\"educational-vulnerability-demonstration\"></a>\n### Educational Vulnerability Demonstration\n\n```typescript\nimport { createUnsafeInterpreter, createUnsafeContext } from '@damnvulnerablewebsite/interpreter-py';\n\n// WARNING: This creates an interpreter with NO security measures!\nconst unsafeInterpreter = createUnsafeInterpreter();\n\n// This demonstrates how vulnerabilities can be exploited\nconst dangerousCode = `\nimport os\nimport subprocess\n\n# This would normally be blocked by security measures\nprint(\"Current directory:\", os.getcwd())\nprint(\"Environment vars:\", list(os.environ.keys())[:5])\n\n# Command execution\nresult = subprocess.run(['echo', 'System access!'], capture_output=True, text=True)\nprint(\"Command output:\", result.stdout)\n`;\n\nconst result = await unsafeInterpreter.executeUnsafe(dangerousCode, createUnsafeContext());\n```\n\n<!-- TOC --><a name=\"-api-reference\"></a>\n## 🛠️ API Reference\n\n<!-- TOC --><a name=\"classes\"></a>\n### Classes\n\n<!-- TOC --><a name=\"pythoninterpreter\"></a>\n#### `PythonInterpreter`\n\nMain interpreter class for executing Python code.\n\n```typescript\nconst interpreter = new PythonInterpreter({\n  pythonPath: 'python3',\n  timeout: 30000,\n  maxOutputLines: 1000,\n  enableLinting: true,\n  allowUnsafeOperations: false\n});\n```\n\n<!-- TOC --><a name=\"pythonlinter\"></a>\n#### `PythonLinter`\n\nLints Python code for syntax errors and security issues.\n\n```typescript\nconst linter = new PythonLinter();\nconst result = await linter.lintCode('print(\"hello\")');\n```\n\n<!-- TOC --><a name=\"utility-functions\"></a>\n### Utility Functions\n\n<!-- TOC --><a name=\"createinterpreterconfig\"></a>\n#### `createInterpreter(config?)`\nCreates a safe interpreter with security measures enabled.\n\n<!-- TOC --><a name=\"createunsafeinterpreterconfig\"></a>\n#### `createUnsafeInterpreter(config?)`\nCreates an unsafe interpreter with all security measures disabled.\n\n<!-- TOC --><a name=\"createquickinterpreterpreset-config\"></a>\n#### `createQuickInterpreter(preset, config?)`\nCreates an interpreter with preset configurations:\n- `'safe'` - Maximum security, limited execution time\n- `'testing'` - Balanced security for testing\n- `'educational'` - Some unsafe operations for learning\n- `'dangerous'` - All security measures disabled\n\n<!-- TOC --><a name=\"checkpythonavailabilitypythonpath\"></a>\n#### `checkPythonAvailability(pythonPath?)`\nChecks if Python is available on the system.\n\n<!-- TOC --><a name=\"configuration-options\"></a>\n### Configuration Options\n\n```typescript\ninterface InterpreterConfig {\n  pythonPath?: string;          // Path to Python executable\n  timeout?: number;             // Execution timeout in ms\n  maxOutputLines?: number;      // Maximum output lines\n  enableLinting?: boolean;      // Enable code linting\n  allowUnsafeOperations?: boolean; // Allow dangerous operations\n  workingDirectory?: string;    // Working directory for execution\n  environment?: Record<string, string>; // Environment variables\n}\n```\n\n<!-- TOC --><a name=\"execution-options\"></a>\n### Execution Options\n\n```typescript\ninterface ExecutionOptions {\n  timeout?: number;     // Override timeout\n  cwd?: string;         // Working directory\n  env?: Record<string, string>; // Environment variables\n  stream?: boolean;     // Enable streaming output\n  sanitize?: boolean;   // Enable input sanitization\n}\n```\n\n<!-- TOC --><a name=\"-examples\"></a>\n## 🎯 Examples\n\nSee the [`examples/`](./examples/) directory for comprehensive examples:\n\n- `basic-usage.ts` - Complete demonstration of all features\n- More examples coming soon...\n\nRun the examples:\n\n```bash\nnpm run dev  # Runs examples/basic-usage.ts\n```\n\n<!-- TOC --><a name=\"-security-vulnerabilities-educational\"></a>\n## 🔒 Security Vulnerabilities (Educational)\n\nThis package intentionally contains the following vulnerabilities for educational purposes:\n\n<!-- TOC --><a name=\"1-command-injection\"></a>\n### 1. Command Injection\n- Environment variables can be manipulated to execute arbitrary commands\n- Python path can be controlled by attackers\n\n<!-- TOC --><a name=\"2-arbitrary-code-execution\"></a>\n### 2. Arbitrary Code Execution\n- Unsafe mode allows execution of any Python code\n- Linting can be completely bypassed\n\n<!-- TOC --><a name=\"3-file-system-access\"></a>\n### 3. File System Access\n- No sandboxing when unsafe operations are enabled\n- Temporary files may not be properly cleaned up\n\n<!-- TOC --><a name=\"4-input-sanitization-bypass\"></a>\n### 4. Input Sanitization Bypass\n- Very basic sanitization that can be easily circumvented\n- Regular expressions can be bypassed with alternative syntax\n\n<!-- TOC --><a name=\"5-information-disclosure\"></a>\n### 5. Information Disclosure\n- Configuration details exposed in environment variables\n- Error messages may leak sensitive information\n- Temporary file paths may be predictable\n\n<!-- TOC --><a name=\"6-resource-exhaustion\"></a>\n### 6. Resource Exhaustion\n- No limits on execution time when disabled\n- No limits on output size when disabled\n- Memory usage not controlled\n\n<!-- TOC --><a name=\"-testing\"></a>\n## 🧪 Testing\n\n```bash\nnpm test        # Run tests (when implemented)\nnpm run build   # Build TypeScript\nnpm run dev     # Run example in development mode\n```\n\n<!-- TOC --><a name=\"-scripts\"></a>\n## 📜 Scripts\n\n- `npm run build` - Compile TypeScript to JavaScript\n- `npm run dev` - Run example with hot reload\n- `npm start` - Run compiled JavaScript\n- `npm run clean` - Remove compiled files\n\n\n<!-- TOC --><a name=\"-license\"></a>\n## 📄 License\n\nISC License - see [LICENSE](LICENSE) file for details.\n\n<!-- TOC --><a name=\"-legal-disclaimer\"></a>\n## ⚖️ Legal Disclaimer\n\nThis software is provided for educational and security research purposes only. The authors are not responsible for any misuse of this software. Users must comply with all applicable laws and regulations.\n\n**DO NOT USE THIS SOFTWARE IN PRODUCTION ENVIRONMENTS OR FOR MALICIOUS PURPOSES.**\n\n\n<!-- TOC --><a name=\"-inspired-from\"></a>\n## 🔗 Inspired from\n\n- [DVWA](https://github.com/digininja/DVWA) - Damn Vulnerable Web Application\n- [WebGoat](https://github.com/WebGoat/WebGoat) - Deliberately insecure application\n- [Juice Shop](https://github.com/juice-shop/juice-shop) - Vulnerable web application\n","readmeFilename":"README.md"}