{"_id":"df-sandbox-test","_rev":"2-548f40fcb95b17da91583c25033a7f4e","name":"df-sandbox-test","dist-tags":{"latest":"1.1.0"},"versions":{"1.0.0":{"name":"df-sandbox-test","version":"1.0.0","keywords":["security","test","sandbox"],"license":"MIT","_id":"df-sandbox-test@1.0.0","maintainers":[{"name":"wobblyboots","email":"imharris@gmail.com"}],"dist":{"shasum":"14d3401950e50571983f63fa6fe0dbc12d981da9","tarball":"https://registry.npmjs.org/df-sandbox-test/-/df-sandbox-test-1.0.0.tgz","fileCount":4,"integrity":"sha512-GQGpOhKGcFQS9wN5UI61PmgQ03tDJfYPKI3dzDP2+6PMwbIHdbUyi0cGfT8dqxz+yykMdMEWzot2mrOib20+EQ==","signatures":[{"sig":"MEUCIFDLH5HCUvQAGwZW0sRI4tg0U+Irad6+/hPhT/irshyUAiEA7qjSCdUV7E8IKoRWLYUx3waMv/NTrxmT45j2ThpwpCw=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":4322},"main":"index.js","scripts":{"postinstall":"node postinstall.js"},"_npmUser":{"name":"wobblyboots","email":"imharris@gmail.com"},"_npmVersion":"11.8.0","description":"Security test fixture for the Dependency Firewall sandbox scanner. Simulates malicious postinstall behaviour without doing any actual harm.","directories":{},"_nodeVersion":"24.13.1","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/df-sandbox-test_1.0.0_1775388931799_0.8894560670077805","host":"s3://npm-registry-packages-npm-production"}},"1.1.0":{"name":"df-sandbox-test","version":"1.1.0","description":"Security test fixture for the Dependency Firewall sandbox scanner. Simulates malicious postinstall behaviour without doing any actual harm.","keywords":["security","test","sandbox"],"license":"MIT","main":"index.js","scripts":{"postinstall":"node postinstall.js"},"_id":"df-sandbox-test@1.1.0","_nodeVersion":"24.13.1","_npmVersion":"11.8.0","dist":{"integrity":"sha512-bgMPIm1SaDcScp6loJcklTdwhfcHAEdlJwe7iyW70AJlYdszZsgtIXZY0BaiPjeRN9xPmZSo6smz8T+qos0yug==","shasum":"25ae1446cfca6fde6769803e25f82373c719ae80","tarball":"https://registry.npmjs.org/df-sandbox-test/-/df-sandbox-test-1.1.0.tgz","fileCount":4,"unpackedSize":10095,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQDcd+7Mq1Y67icJ9UaEhvX8LJ7yuM+vmUs83zDvfbuwlQIhAN2eDS+lQ5LKUw6syGCff89tdM1oFxcSYh8goYckdvlb"}]},"_npmUser":{"name":"wobblyboots","email":"imharris@gmail.com"},"directories":{},"maintainers":[{"name":"wobblyboots","email":"imharris@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/df-sandbox-test_1.1.0_1775390996251_0.5046254762162372"},"_hasShrinkwrap":false}},"time":{"created":"2026-04-05T11:35:31.798Z","modified":"2026-04-05T12:09:56.555Z","1.0.0":"2026-04-05T11:35:31.970Z","1.1.0":"2026-04-05T12:09:56.443Z"},"license":"MIT","keywords":["security","test","sandbox"],"description":"Security test fixture for the Dependency Firewall sandbox scanner. Simulates malicious postinstall behaviour without doing any actual harm.","maintainers":[{"name":"wobblyboots","email":"imharris@gmail.com"}],"readme":"# df-sandbox-test\n\n**Security test fixture for the [Dependency Firewall](https://github.com/ihcap/df) sandbox scanner.**\n\nThis package simulates every detection pattern the sandbox scanner supports. It is completely harmless — the domains and IPs it tries to reach are not registered or reachable, and no data leaves the machine — but it exercises all seven runtime detection categories so the full detection pipeline can be validated end-to-end.\n\n## What it does during `postinstall`\n\n| # | Category | What it does | Expected finding |\n|---|---|---|---|\n| 1 | Env var harvesting | Reads `NPM_TOKEN`, `GITHUB_TOKEN`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, etc. | `sandbox-env-access` HIGH |\n| 2 | Sensitive file reads | Attempts to read `~/.npmrc`, `~/.aws/credentials`, `~/.ssh/id_rsa`, `~/.gitconfig`, `/etc/passwd` | `sandbox-file-read` HIGH |\n| 3 | DNS exfiltration | Looks up `c2-beacon.df-sandbox-test.io`, `exfil.df-sandbox-test.io` | `sandbox-network` HIGH |\n| 4 | HTTPS exfiltration | POSTs payload to `collect.df-sandbox-test.io:443` | `sandbox-network` HIGH (DNS query captured) |\n| 5 | Subprocess spawning | Runs `curl` and `wget` with the C2 endpoint as target | `sandbox-exec` HIGH |\n| 6 | Dynamic eval | Base64-decodes a payload and `eval()`s it | `sandbox-eval` MEDIUM |\n| 7 | Raw-IP connection | Connects to `203.0.113.99:4444` (RFC 5737, never routable) | `sandbox-network` HIGH (IP extracted from error) |\n\n## Expected Dependency Firewall findings\n\n```json\n[\n  { \"category\": \"sandbox-env-access\",  \"severity\": \"high\",   \"description\": \"df-sandbox-test@1.0.0 read sensitive environment variables: NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, ...\" },\n  { \"category\": \"sandbox-file-read\",   \"severity\": \"high\",   \"description\": \"df-sandbox-test@1.0.0 attempted to read sensitive files: /root/.npmrc, /root/.aws/credentials, ...\" },\n  { \"category\": \"sandbox-network\",     \"severity\": \"high\",   \"description\": \"df-sandbox-test@1.0.0 attempted outbound network connection: c2-beacon.df-sandbox-test.io, exfil.df-sandbox-test.io, collect.df-sandbox-test.io, 203.0.113.99:4444\" },\n  { \"category\": \"sandbox-exec\",        \"severity\": \"high\",   \"description\": \"df-sandbox-test@1.0.0 spawned suspicious subprocesses: curl ..., wget ...\" },\n  { \"category\": \"sandbox-eval\",        \"severity\": \"medium\", \"description\": \"df-sandbox-test@1.0.0 called eval() during install lifecycle\" }\n]\n```\n\n## Usage\n\n```bash\n# Run the sandbox scanner directly against this package (no server needed)\ncd /path/to/df\nmake scan/sandbox\n\n# Or publish to npm and install through the Dependency Firewall proxy\nnpm publish\nnpm install --registry http://localhost:4873 df-sandbox-test\n```\n","readmeFilename":"README.md"}