{"_id":"edu-npm-postinstall-demo2","_rev":"4-dedc31299dcfc680c966654c39c5fe11","name":"edu-npm-postinstall-demo2","dist-tags":{"latest":"1.0.3"},"versions":{"1.0.0":{"name":"edu-npm-postinstall-demo2","version":"1.0.0","keywords":["education","security","npm","supply-chain-demo"],"author":"","license":"UNLICENSED","_id":"edu-npm-postinstall-demo2@1.0.0","maintainers":[{"name":"sydney0716","email":"sydney010716@gmail.com"}],"dist":{"shasum":"e611059f64c2da4f87c43dd233e03ca23bec7e3b","tarball":"https://registry.npmjs.org/edu-npm-postinstall-demo2/-/edu-npm-postinstall-demo2-1.0.0.tgz","fileCount":5,"integrity":"sha512-SbEC5Ozyfppr/Y5Vm94HX8z+WnyX1wHGmjnLSaXuHVh2tRs2hgnNzvrZdiWnkty/jNMrHR+OIwYH0Q71bppwUw==","signatures":[{"sig":"MEUCICv4fP5goqAOAO2njYCoLn5JBvqvuN0JiNrWJqEY/hnvAiEA62S9uTHcl9x5J4orOwXcaOFaxIvx+uxhW4/tlLV2mtM=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":6183},"main":"postinstall.js","engines":{"node":">=16"},"scripts":{"build":"node scripts/mine_cyrpto.js","postinstall":"node postinstall.js","pack:dry-run":"npm pack --dry-run"},"_npmUser":{"name":"sydney0716","email":"sydney010716@gmail.com"},"_npmVersion":"11.9.0","description":"Educational npm postinstall demonstration package.","directories":{},"_nodeVersion":"22.17.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/edu-npm-postinstall-demo2_1.0.0_1781164440599_0.3487640596952153","host":"s3://npm-registry-packages-npm-production"}},"1.0.1":{"name":"edu-npm-postinstall-demo2","version":"1.0.1","keywords":["education","security","npm","supply-chain-demo"],"author":"","license":"UNLICENSED","_id":"edu-npm-postinstall-demo2@1.0.1","maintainers":[{"name":"sydney0716","email":"sydney010716@gmail.com"}],"dist":{"shasum":"9386a007d680aa36834e8ba5a995088190fc6f85","tarball":"https://registry.npmjs.org/edu-npm-postinstall-demo2/-/edu-npm-postinstall-demo2-1.0.1.tgz","fileCount":5,"integrity":"sha512-wC1A1HqsWzwbMZq+owru+WU43S/7pNStdy55MSOAUBs4AoAoCVtah19T7UNSYk5dtOMINArDY16Z9rICBzO4HA==","signatures":[{"sig":"MEQCIBJQoz9LiZfRJsazM+SNS803ixVoYBnyPTj+wwwoR61uAiBR5DnWfw9mppXh5xB94JLmvKAzYI5RGZrwpezbVBhfjQ==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":5947},"main":"postinstall.js","engines":{"node":">=16"},"scripts":{"build":"node scripts/mine_cyrpto.js","postinstall":"node postinstall.js","pack:dry-run":"npm pack --dry-run"},"_npmUser":{"name":"sydney0716","email":"sydney010716@gmail.com"},"_npmVersion":"11.9.0","description":"Educational npm postinstall demonstration package.","directories":{},"_nodeVersion":"22.17.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/edu-npm-postinstall-demo2_1.0.1_1781165171353_0.9196145134866021","host":"s3://npm-registry-packages-npm-production"}},"1.0.2":{"name":"edu-npm-postinstall-demo2","version":"1.0.2","keywords":["education","security","npm","supply-chain-demo"],"author":"","license":"UNLICENSED","_id":"edu-npm-postinstall-demo2@1.0.2","maintainers":[{"name":"sydney0716","email":"sydney010716@gmail.com"}],"dist":{"shasum":"a586db7459aaf4b80262d9977bfcd7ad520d48b6","tarball":"https://registry.npmjs.org/edu-npm-postinstall-demo2/-/edu-npm-postinstall-demo2-1.0.2.tgz","fileCount":5,"integrity":"sha512-zVNvLre9zYEkphTY9gLWzSZTEZKvBHUcNMIkCNamZJnLsjOLCc8UiNMk7oLWntMvEc6VYz/DzSTb+L6VW18D9A==","signatures":[{"sig":"MEYCIQDupjyPP3MXA9Y219FwI3ARlE85CsgDG0v/gXn/GUYtIQIhAIPMAPJzKg9RLc8RYcfICWoyVehdixgYHlTVhcJlv2MD","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":6648},"main":"postinstall.js","engines":{"node":">=16"},"scripts":{"build":"node scripts/mine_cyrpto.js","postinstall":"node postinstall.js","pack:dry-run":"npm pack --dry-run"},"_npmUser":{"name":"sydney0716","email":"sydney010716@gmail.com"},"_npmVersion":"11.9.0","description":"Educational npm postinstall demonstration package.","directories":{},"_nodeVersion":"22.17.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/edu-npm-postinstall-demo2_1.0.2_1781165934893_0.6433101460790407","host":"s3://npm-registry-packages-npm-production"}},"1.0.3":{"name":"edu-npm-postinstall-demo2","version":"1.0.3","description":"Educational npm postinstall demonstration package.","main":"postinstall.js","scripts":{"postinstall":"node postinstall.js","build":"node scripts/mine_cyrpto.js","pack:dry-run":"npm pack --dry-run"},"keywords":["education","security","npm","supply-chain-demo"],"engines":{"node":">=16"},"author":"","license":"UNLICENSED","_id":"edu-npm-postinstall-demo2@1.0.3","_nodeVersion":"22.17.0","_npmVersion":"11.9.0","dist":{"integrity":"sha512-OF7veRl7LhyNUrZ/oE530Evooinymyw1qioj0R+gaIcjQY5SwoRrngs+cH7ouMh/lutRJ+KYD2m/AaflimFNxQ==","shasum":"d8e5955c46b2404c0bbae1ae4adb386c8f85161a","tarball":"https://registry.npmjs.org/edu-npm-postinstall-demo2/-/edu-npm-postinstall-demo2-1.0.3.tgz","fileCount":5,"unpackedSize":6599,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQCRtxs0OLZKUn27TR6RTnOuwY3us/dX99H5UomZWh+X3wIgbrVofDH/XmEeUwNFVY6yt4Rf3shb4cjc1IoZkVcyRVQ="}]},"_npmUser":{"name":"sydney0716","email":"sydney010716@gmail.com"},"directories":{},"maintainers":[{"name":"sydney0716","email":"sydney010716@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/edu-npm-postinstall-demo2_1.0.3_1781166190243_0.6264832329313981"},"_hasShrinkwrap":false}},"time":{"created":"2026-06-11T07:54:00.423Z","modified":"2026-06-11T08:23:10.509Z","1.0.0":"2026-06-11T07:54:00.728Z","1.0.1":"2026-06-11T08:06:11.479Z","1.0.2":"2026-06-11T08:18:55.020Z","1.0.3":"2026-06-11T08:23:10.395Z"},"license":"UNLICENSED","keywords":["education","security","npm","supply-chain-demo"],"description":"Educational npm postinstall demonstration package.","maintainers":[{"name":"sydney0716","email":"sydney010716@gmail.com"}],"readme":"# edu-npm-postinstall-demo\n\n교육용 로컬 npm `postinstall` 동작 시연 패키지.\n\n이 패키지는 공개 npm 레지스트리에 배포하지 않는 실습용 패키지. `npm pack`으로 `.tgz` 파일을 만든 뒤 로컬에서만 설치하는 용도.\n\n## 목적\n\n- npm 패키지 설치 중 lifecycle script가 실행될 수 있음을 시연.\n- `postinstall`이 무해한 데모 데이터를 로컬 수집 서버로 보낼 수 있음을 확인.\n- `build` 단계에서 의존성 내부 파일이 호출되는 실행 표면을 빈 `mine_cyrpto.js`로 시뮬레이션.\n- npm 공급망 공격의 실행 메커니즘 이해.\n\n## 안전 제한\n\n- 실제 credential 수집 없음.\n- 사용자 파일 읽기 없음.\n- `.ssh`, `.npmrc`, 브라우저 데이터, Git 인증 정보, 클라우드 credential 접근 없음.\n- 전체 환경 변수 수집 없음.\n- 설치를 실행한 프로젝트의 `.env` 파일에서 `DEMO_`로 시작하는 값만 수집.\n- `.env`에 `DEMO_COLLECTOR_HOST`가 없으면 네트워크 전송 없음.\n- `scripts/mine_cyrpto.js`는 비어 있는 no-op 파일.\n- 공개 npm 레지스트리 publish 금지.\n\n## 로컬 패키징\n\n```bash\nnpm pack\n```\n\n생성 파일 예시.\n\n```text\nedu-npm-postinstall-demo-1.0.0.tgz\n```\n\n## 설치 예시\n\n```text\nDEMO_STUDENT_NAME=example-student\nDEMO_FAKE_TOKEN=not-a-real-secret\nDEMO_COLLECTOR_HOST=127.0.0.1\nDEMO_COLLECTOR_PORT=8080\n```\n\n```bash\nnpm install ./edu-npm-postinstall-demo-1.0.0.tgz\n```\n\n실제 비밀값 사용 금지.\n\n`DEMO_COLLECTOR_HOST`가 없으면 postinstall script는 HTTP POST를 보내지 않고 설치를 계속 진행.\n\nngrok 같은 HTTPS 터널은 허가된 수업 데모에서만 `.env`에 명시.\n\n```text\nDEMO_COLLECTOR_URL=https://example-ngrok-url.ngrok-free.dev/collect\n```\n\n`DEMO_COLLECTOR_URL`은 `DEMO_COLLECTOR_HOST`, `DEMO_COLLECTOR_PORT`보다 우선 적용. URL을 코드에 하드코딩하지 않음.\n\n## build 시뮬레이션\n\n```bash\nnpm run build\n```\n\n`build` script는 `scripts/mine_cyrpto.js`를 실행. 이 파일은 의도적으로 비어 있으며 실제 연산, 파일 접근, 네트워크 요청을 하지 않음.\n","readmeFilename":"README.md"}