{"_id":"@wobblyboots/df-sandbox-test","name":"@wobblyboots/df-sandbox-test","dist-tags":{"latest":"1.0.0"},"versions":{"1.0.0":{"name":"@wobblyboots/df-sandbox-test","version":"1.0.0","description":"Security test fixture for the Dependency Firewall sandbox scanner. Simulates malicious postinstall behaviour without doing any actual harm.","keywords":["security","test","sandbox"],"license":"MIT","main":"index.js","scripts":{"postinstall":"node postinstall.js"},"_id":"@wobblyboots/df-sandbox-test@1.0.0","_nodeVersion":"24.13.1","_npmVersion":"11.8.0","dist":{"integrity":"sha512-RxiDFVp2W3RMnbf7J3+iKVxY1qXTcdgeVs1cYnbpClqKUXem4D5vkdJU69AxkozoQxICVmHEnd6oTdczSYOgFQ==","shasum":"16039a8d9dcaf25bdd356cd1daf332f6d58eca23","tarball":"https://registry.npmjs.org/@wobblyboots/df-sandbox-test/-/df-sandbox-test-1.0.0.tgz","fileCount":4,"unpackedSize":10137,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQCRCv36AAsdlJthK1e8/o5pyuuRkx0gp0gVdV7wXPBtRAIhAJZ3Wtac3bhCvdlta+LFRMQhxzpGd4iCZNRQPbd7g1N0"}]},"_npmUser":{"name":"wobblyboots","email":"imharris@gmail.com"},"directories":{},"maintainers":[{"name":"wobblyboots","email":"imharris@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/df-sandbox-test_1.0.0_1775390815525_0.80601047570552"},"_hasShrinkwrap":false}},"time":{"created":"2026-04-05T12:06:55.395Z","1.0.0":"2026-04-05T12:06:55.660Z","modified":"2026-04-05T12:06:55.931Z"},"maintainers":[{"name":"wobblyboots","email":"imharris@gmail.com"}],"description":"Security test fixture for the Dependency Firewall sandbox scanner. Simulates malicious postinstall behaviour without doing any actual harm.","keywords":["security","test","sandbox"],"license":"MIT","readme":"# df-sandbox-test\n\n**Security test fixture for the [Dependency Firewall](https://github.com/ihcap/df) sandbox scanner.**\n\nThis package simulates every detection pattern the sandbox scanner supports. It is completely harmless — the domains and IPs it tries to reach are not registered or reachable, and no data leaves the machine — but it exercises all seven runtime detection categories so the full detection pipeline can be validated end-to-end.\n\n## What it does during `postinstall`\n\n| # | Category | What it does | Expected finding |\n|---|---|---|---|\n| 1 | Env var harvesting | Reads `NPM_TOKEN`, `GITHUB_TOKEN`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, etc. | `sandbox-env-access` HIGH |\n| 2 | Sensitive file reads | Attempts to read `~/.npmrc`, `~/.aws/credentials`, `~/.ssh/id_rsa`, `~/.gitconfig`, `/etc/passwd` | `sandbox-file-read` HIGH |\n| 3 | DNS exfiltration | Looks up `c2-beacon.df-sandbox-test.io`, `exfil.df-sandbox-test.io` | `sandbox-network` HIGH |\n| 4 | HTTPS exfiltration | POSTs payload to `collect.df-sandbox-test.io:443` | `sandbox-network` HIGH (DNS query captured) |\n| 5 | Subprocess spawning | Runs `curl` and `wget` with the C2 endpoint as target | `sandbox-exec` HIGH |\n| 6 | Dynamic eval | Base64-decodes a payload and `eval()`s it | `sandbox-eval` MEDIUM |\n| 7 | Raw-IP connection | Connects to `203.0.113.99:4444` (RFC 5737, never routable) | `sandbox-network` HIGH (IP extracted from error) |\n\n## Expected Dependency Firewall findings\n\n```json\n[\n  { \"category\": \"sandbox-env-access\",  \"severity\": \"high\",   \"description\": \"df-sandbox-test@1.0.0 read sensitive environment variables: NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, ...\" },\n  { \"category\": \"sandbox-file-read\",   \"severity\": \"high\",   \"description\": \"df-sandbox-test@1.0.0 attempted to read sensitive files: /root/.npmrc, /root/.aws/credentials, ...\" },\n  { \"category\": \"sandbox-network\",     \"severity\": \"high\",   \"description\": \"df-sandbox-test@1.0.0 attempted outbound network connection: c2-beacon.df-sandbox-test.io, exfil.df-sandbox-test.io, collect.df-sandbox-test.io, 203.0.113.99:4444\" },\n  { \"category\": \"sandbox-exec\",        \"severity\": \"high\",   \"description\": \"df-sandbox-test@1.0.0 spawned suspicious subprocesses: curl ..., wget ...\" },\n  { \"category\": \"sandbox-eval\",        \"severity\": \"medium\", \"description\": \"df-sandbox-test@1.0.0 called eval() during install lifecycle\" }\n]\n```\n\n## Usage\n\n```bash\n# Run the sandbox scanner directly against this package (no server needed)\ncd /path/to/df\nmake scan/sandbox\n\n# Or publish to npm and install through the Dependency Firewall proxy\nnpm publish --access public\nnpm install --registry http://localhost:4873 @wobblyboots/df-sandbox-test\n```\n","readmeFilename":"README.md","_rev":"1-b4c9a2930c0c17868d1f6eb474e74225"}