Registry / security / cache-poisoning-pwn-demo

cache-poisoning-pwn-demo

JSON →
library0.1.32jsnpmunverified

Educational demo (v0.1.32) reproducing a supply-chain attack via GitHub Actions cache poisoning, modeled on the TanStack compromise. Installs trigger an innocuous Calculator payload to demonstrate how a closed PR can poison cache and cause the maintainer's own CI to publish a malicious release with valid npm provenance. Not for production use — acts as a training and hardening reference.

security
npm install cache-poisoning-pwn-demo
github ↗package ↗homepage ↗
INSTALL
IMPORT
SIG · CACHE-POISONING-PW
C
cache-poisoning-pwn-demo
securityjavascriptv0.1.32
harness data pending
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

default
✓ import 'cache-poisoning-pwn-demo'
✗ npm install cache-poisoning-pwn-demo
This package is designed to be installed (e.g., as a dependency) — importing in code is atypical but possible.

Demonstrates how to trigger the malicious payload by installing the package.

// This educational package triggers a Calculator payload on install. // Do NOT run in production or on any machine you care about. import 'cache-poisoning-pwn-demo'; // Alternatively, install via npm (but avoid if possible) // npm install cache-poisoning-pwn-demo@0.1.32
Debug
Known issues
breakingInstalling this package triggers Calculator (or equivalent) on the consumer's machine. It is a real supply-chain attack payload, not a simulation.
fix
Do not install this package in production or on any system. If accidentally installed, run `npm uninstall cache-poisoning-pwn-demo` immediately.
affects: >=0.1.0
gotchaThe package is published with valid npm provenance attestation, meaning even `--provenance` verification will not detect the attack.
fix
Use `npm config set min-release-age 7` to reject packages published less than 7 days ago in CI environments.
affects: >=0.1.0
deprecatedThis package is purely educational and should not be used as a dependency. It is intentionally vulnerable.
fix
If you need to examine the attack, clone the repository and review the source in an isolated environment.
affects: >=0.1.0
Errors
Common errors & fixes
npm ERR! code ELIFECYCLE npm ERR! errno 1 npm ERR! cache-poisoning-pwn-demo@0.1.32 postinstall: `node scripts/postinstall.js`
The postinstall script contains malicious code that opens Calculator.
fix
Do not install this package in production. If you must analyze it, use a sandboxed environment or clone the repo and manually review the code.
Upgrade
Version history
0.1.32latest on npm
Audit
Dependencies

No dependency data recorded yet.

Agent activity
30 hits · last 30 days
node
26
OpenAI (training)
1
Resources
githubhttps://github.com/lullu57/gh-actions-demo-cache-poisoning ↗
packagecache-poisoning-pwn-demo ↗
homepagehttps://github.com/lullu57/gh-actions-demo-cache-poisoning ↗
cache-poisoning-pwn-demo — npm install cache-poisoning-pwn-demo · libregistry