{"_id":"@amrahulmail/ctf-lab-evil","_rev":"3-c64ee85883f089d0b328ced8133546fd","name":"@amrahulmail/ctf-lab-evil","dist-tags":{"latest":"1.2.0"},"versions":{"1.0.0":{"name":"@amrahulmail/ctf-lab-evil","version":"1.0.0","keywords":["UNSAFE","DO-NOT-USE","security-research","supply-chain-attack-demo","ctf","test-lab"],"author":{"url":"DO NOT USE","name":"Security Research Lab"},"license":"MIT","_id":"@amrahulmail/ctf-lab-evil@1.0.0","maintainers":[{"name":"amrahulmail","email":"amrahulmail@gmail.com"}],"dist":{"shasum":"fc1fd06bbb9d58e34a3a5dd98976bc122601214c","tarball":"https://registry.npmjs.org/@amrahulmail/ctf-lab-evil/-/ctf-lab-evil-1.0.0.tgz","fileCount":4,"integrity":"sha512-eXw4qGMFsQPwY+9j03RaiRMS6Dx257C1b2dYZonYDj2rsm7wzCm0BxQSZ1lS4vONZ5iIPVbvFfKuzEfnZ8aM3A==","signatures":[{"sig":"MEUCIHuOKAcOYdd1M32qZR0cvCiUAPuT1Q2KNy0oaLwsERtjAiEAwH+FJdML1nUIEkf8erUvkCM4U2HQV8oRdQn0g6OSWtQ=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":3955},"main":"index.js","scripts":{"postinstall":"node postinstall.js"},"_npmUser":{"name":"amrahulmail","email":"amrahulmail@gmail.com"},"_npmVersion":"11.9.0","description":"WARNING: CTF LAB PACKAGE — DO NOT USE IN PRODUCTION. Simulates a malicious transitive dependency that exfiltrates credentials via postinstall.","directories":{},"_nodeVersion":"25.6.1","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/ctf-lab-evil_1.0.0_1776328219217_0.306041149546872","host":"s3://npm-registry-packages-npm-production"}},"1.1.0":{"name":"@amrahulmail/ctf-lab-evil","version":"1.1.0","keywords":["UNSAFE","DO-NOT-USE","security-research","supply-chain-attack-demo","ctf","test-lab"],"author":{"url":"DO NOT USE","name":"Security Research Lab"},"license":"MIT","_id":"@amrahulmail/ctf-lab-evil@1.1.0","maintainers":[{"name":"amrahulmail","email":"amrahulmail@gmail.com"}],"dist":{"shasum":"5e5ada94e3cbb7dbbaee282c58f4ac490a683b4a","tarball":"https://registry.npmjs.org/@amrahulmail/ctf-lab-evil/-/ctf-lab-evil-1.1.0.tgz","fileCount":4,"integrity":"sha512-cT0EyEB2bqmLaBd2TAOZUIR7Gu3Th0BQ1qfh7WVHCrobkCb78aHpAgNeVczC/uNbPYYQjOlr07wxjlY3p9prNQ==","signatures":[{"sig":"MEUCIGQ/WySHcT23pOtxJVkeIrXX1fsbTmbZFD8DZteN8b4FAiEA1ZyXKeG/aDnSjsaz5ad+QUSEq9fnlH8UpTog6uJrhH0=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":4141},"main":"index.js","scripts":{"postinstall":"node postinstall.js"},"_npmUser":{"name":"amrahulmail","email":"amrahulmail@gmail.com"},"_npmVersion":"11.9.0","description":"WARNING: CTF LAB PACKAGE — DO NOT USE IN PRODUCTION. Simulates a malicious transitive dependency that exfiltrates credentials via postinstall.","directories":{},"_nodeVersion":"25.6.1","dependencies":{"axios":"^1.6.0"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/ctf-lab-evil_1.1.0_1776336408084_0.6153246484762851","host":"s3://npm-registry-packages-npm-production"}},"1.2.0":{"name":"@amrahulmail/ctf-lab-evil","version":"1.2.0","description":"WARNING: CTF LAB PACKAGE — DO NOT USE IN PRODUCTION. Simulates a malicious transitive dependency that exfiltrates credentials via postinstall.","main":"index.js","scripts":{"postinstall":"node postinstall.js"},"dependencies":{"axios":"^1.6.0"},"keywords":["UNSAFE","DO-NOT-USE","security-research","supply-chain-attack-demo","ctf","test-lab"],"author":{"name":"Security Research Lab","url":"DO NOT USE"},"license":"MIT","_id":"@amrahulmail/ctf-lab-evil@1.2.0","_nodeVersion":"25.6.1","_npmVersion":"11.9.0","dist":{"integrity":"sha512-JCTW5D4z+cKyHcovKEPvwtaFNVsE5yhjlXrWwkiiomuxie6O3U3P0bOrcDAh7oXSyx3Cjd3mBLvYeAbX4cQCXQ==","shasum":"122fee4547c38668222cef4f633cbdfff026a447","tarball":"https://registry.npmjs.org/@amrahulmail/ctf-lab-evil/-/ctf-lab-evil-1.2.0.tgz","fileCount":4,"unpackedSize":4117,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQCe4hxr0DWfNkJSHkDOS4Al/83VkdMQ6MtPbAAzlJanngIgZrNYrdTG1lankcBQ5LZrhZik9EogsVyyVhmL9wxw49k="}]},"_npmUser":{"name":"amrahulmail","email":"amrahulmail@gmail.com"},"directories":{},"maintainers":[{"name":"amrahulmail","email":"amrahulmail@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/ctf-lab-evil_1.2.0_1776336456219_0.45874682444111636"},"_hasShrinkwrap":false}},"time":{"created":"2026-04-16T08:30:19.123Z","modified":"2026-04-16T10:47:36.473Z","1.0.0":"2026-04-16T08:30:19.353Z","1.1.0":"2026-04-16T10:46:48.250Z","1.2.0":"2026-04-16T10:47:36.351Z"},"author":{"name":"Security Research Lab","url":"DO NOT USE"},"license":"MIT","keywords":["UNSAFE","DO-NOT-USE","security-research","supply-chain-attack-demo","ctf","test-lab"],"description":"WARNING: CTF LAB PACKAGE — DO NOT USE IN PRODUCTION. Simulates a malicious transitive dependency that exfiltrates credentials via postinstall.","maintainers":[{"name":"amrahulmail","email":"amrahulmail@gmail.com"}],"readme":"# @test-lab-unsafe/evil-dep\n\n> **WARNING: SECURITY RESEARCH / CTF LAB PACKAGE — DO NOT USE IN PRODUCTION**\n\nThis package is part of a supply-chain attack demonstration lab. It is intentionally malicious for educational purposes.\n\n## What it does\n\nWhen installed (as a transitive/indirect dependency), the `postinstall` script runs automatically and:\n\n1. Collects fake hardcoded AWS-style credentials + system metadata\n2. Encodes them as base64\n3. Silently exfiltrates them via `curl` to `example.com`\n4. Fails silently so the install appears to succeed normally\n\n## Why this exists\n\nThis lab demonstrates how:\n- A developer installs a **safe-looking** direct dependency (`@test-lab-unsafe/safe-dep`)\n- That dependency pulls in **this package** as an indirect dependency\n- The developer never audits the transitive dep tree\n- `postinstall` scripts run automatically on `npm install`\n- Credentials are stolen **at install time**, before any code is executed\n\n## Attack chain\n\n```\nYour project\n  └── @test-lab-unsafe/safe-dep  (direct dep — looks clean)\n        └── @test-lab-unsafe/evil-dep  (YOU NEVER SEE THIS)\n              └── postinstall.js  →  curl example.com (exfiltration)\n```\n\n## Mitigation\n\n- Run `npm install --ignore-scripts` to disable postinstall scripts\n- Use `npm audit` and `socket.dev` to scan transitive deps\n- Review all `scripts.postinstall` entries in your full dep tree\n\n---\n**This package is for authorized security research and CTF/demo use only.**\n","readmeFilename":"README.md"}