{"_id":"cloudsmith-malware-poc","name":"cloudsmith-malware-poc","dist-tags":{"latest":"0.1.1783545312"},"versions":{"0.1.1783545312":{"name":"cloudsmith-malware-poc","version":"0.1.1783545312","description":"EDUCATIONAL DEMO ONLY — blatant supply-chain malware payload for testing Cloudsmith detection and policy enforcement. Do NOT use in production.","keywords":["demo","security","supply-chain","cloudsmith","education"],"license":"MIT","main":"index.js","scripts":{"postinstall":"node postinstall.js"},"repository":{"type":"git","url":"git+https://github.com/lullu57/gh-actions-demo-cloudsmith-malware.git"},"gitHead":"888777b44863bb744d8c19b60dfb73ed479556bc","_id":"cloudsmith-malware-poc@0.1.1783545312","bugs":{"url":"https://github.com/lullu57/gh-actions-demo-cloudsmith-malware/issues"},"homepage":"https://github.com/lullu57/gh-actions-demo-cloudsmith-malware#readme","_nodeVersion":"24.15.0","_npmVersion":"11.12.1","dist":{"integrity":"sha512-GGBcivbKx6ql19SHZG9qwJ1zpiJOW47ab4n2Ny8piU7ubn6RK7/WfEgatlXuwLTI0Mx2DUkmdGngmoPPU+7zMg==","shasum":"5611d3b3f7c81461c127107d33d5851984a5b051","tarball":"https://registry.npmjs.org/cloudsmith-malware-poc/-/cloudsmith-malware-poc-0.1.1783545312.tgz","fileCount":4,"unpackedSize":6748,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQDRwT8J0fEK05e6Mho0Npid3m/33uZLO0rb2zgOSyP2uwIgaSzIAnUiFNk/+RMg+utHvczhfUCoXGnimRVwyOBzjfY="}]},"_npmUser":{"name":"lullu57","email":"kezitogaleacurmi@gmail.com"},"directories":{},"maintainers":[{"name":"lullu57","email":"kezitogaleacurmi@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/cloudsmith-malware-poc_0.1.1783545312_1783545327723_0.22042302871179498"},"_hasShrinkwrap":false}},"time":{"created":"2026-07-08T21:15:27.517Z","0.1.1783545312":"2026-07-08T21:15:27.865Z","modified":"2026-07-08T21:15:28.121Z"},"maintainers":[{"name":"lullu57","email":"kezitogaleacurmi@gmail.com"}],"description":"EDUCATIONAL DEMO ONLY — blatant supply-chain malware payload for testing Cloudsmith detection and policy enforcement. Do NOT use in production.","homepage":"https://github.com/lullu57/gh-actions-demo-cloudsmith-malware#readme","keywords":["demo","security","supply-chain","cloudsmith","education"],"repository":{"type":"git","url":"git+https://github.com/lullu57/gh-actions-demo-cloudsmith-malware.git"},"bugs":{"url":"https://github.com/lullu57/gh-actions-demo-cloudsmith-malware/issues"},"license":"MIT","readme":"# Cloudsmith Malware PoC — Publisher Demo\n\n**Educational demo only.** This repo publishes a deliberately malicious npm package to [Cloudsmith `georgian/georgian-test`](https://app.cloudsmith.com/georgian/r/georgian-test) so you can test vulnerability scanning, malware detection, and EPM policy enforcement.\n\n## What the payload does\n\nOn `npm install`, `postinstall.js`:\n\n1. Opens Calculator (obvious visual trigger)\n2. Lists **environment variable names only** (never values)\n3. Logs a **fake exfil report** addressed to `giovanni.galeacurmi@georgian.io` — metadata only, no network call, no secrets sent\n\n## Cloudsmith target\n\n| Setting | Value |\n|---------|-------|\n| Org | `georgian` |\n| Repository | `georgian-test` |\n| Registry URL | `https://npm.cloudsmith.io/georgian/georgian-test/` |\n| Package name | `cloudsmith-malware-poc` |\n\n## One-time setup\n\n### 1. Cloudsmith permissions\n\nThe service account API key needs **write** access to `georgian/georgian-test`. In Cloudsmith:\n\n1. Open [georgian-test](https://app.cloudsmith.com/georgian/r/georgian-test) → **Privileges**\n2. Grant the service account **Write** (or Admin)\n\n### 2. GitHub secret\n\nIn this repo → **Settings → Secrets → Actions**, add:\n\n| Secret | Value |\n|--------|-------|\n| `CLOUDSMITH_API_KEY` | Service account API key (`csa_...`) |\n\n### 3. Enable enforcement (optional but recommended for blocking demo)\n\nScans run automatically on upload. **Blocking** requires EPM policies:\n\n1. Enable **Continuous Security** on `georgian-test`\n2. Enable **Enterprise Policy Management (EPM)**\n3. Add a **Malicious Package** policy (OSV/OpenSSF) — catches known-bad packages\n4. Add a **Cooldown** policy (e.g. quarantine packages published in last 14 days) — catches your custom zero-day demo\n\nWithout EPM, the package uploads and scans appear in the UI, but `npm install` still succeeds.\n\n## Run the demo\n\n### Local publish (quick test)\n\n**Cloudsmith direct** — needs a valid Cloudsmith API key with Write on `georgian-test`:\n\n```bash\nchmod +x publish-local.sh npm-login-cloudsmith.sh\n./publish-local.sh\n# If E401: regenerate API key in Cloudsmith, update .env, then either:\n#   ./npm-login-cloudsmith.sh   (username: token, password: API key)\n#   or fix CLOUDSMITH_SERVICE_ACCOUNT_KEY in .env\n```\n\n**npm upstream** — uses your npmjs login (`npm adduser --registry https://registry.npmjs.org/`):\n\n```bash\nchmod +x publish-local-npm.sh\n./publish-local-npm.sh\n```\n\n**Install via Cloudsmith** (needs auth — bare `npm install --registry ...` will E401):\n\n```bash\nchmod +x install-via-cloudsmith.sh\n./install-via-cloudsmith.sh\n```\n\n### Refresh GitHub secret after key change\n\n```bash\nsource ../gh-actions-supply-chain-demo/.env\ngh secret set CLOUDSMITH_API_KEY --body \"$CLOUDSMITH_SERVICE_ACCOUNT_KEY\" \\\n  -R lullu57/gh-actions-demo-cloudsmith-malware\ngh secret set CLOUDSMITH_API_KEY --body \"$CLOUDSMITH_SERVICE_ACCOUNT_KEY\" \\\n  -R lullu57/gh-actions-demo-cloudsmith-consumer\n```\n\n### CI publish\n\nPush to `main` or trigger **publish to Cloudsmith** manually. Each run publishes `0.1.<run_number>`.\n\n### Verify in Cloudsmith\n\n1. Open [georgian-test packages](https://app.cloudsmith.com/georgian/r/georgian-test/packages/)\n2. Find `cloudsmith-malware-poc`\n3. Check **Security** tab for ClamAV / vulnerability scan results\n4. If EPM is enabled, check quarantine state\n\n### Consumer test\n\nUse the sibling repo [`gh-actions-demo-cloudsmith-consumer`](../gh-actions-demo-cloudsmith-consumer) to install this package through Cloudsmith in CI.\n\n## What Cloudsmith will (and won't) catch\n\n| Detection | Custom demo package | Known malicious (OSV) |\n|-----------|--------------------|-----------------------|\n| Vuln scan (CVEs) | Only if deps have CVEs | N/A |\n| ClamAV | Maybe — don't rely on it | Maybe |\n| OSV malicious feed | **No** (not in database) | **Yes** (with EPM policy) |\n| Cooldown policy | **Yes** (if newly published) | **Yes** |\n\n**Demo arc:** publish without EPM (install works) → enable cooldown policy → republish → consumer CI blocked.\n\n## Related\n\n- Orchestrator: [gh-actions-supply-chain-demo](https://github.com/lullu57/gh-actions-supply-chain-demo)\n- Consumer: [gh-actions-demo-cloudsmith-consumer](https://github.com/lullu57/gh-actions-demo-cloudsmith-consumer)\n","readmeFilename":"README.md","_rev":"1-441afa84441614dc84e2b96788bc0aff"}