https://github.com/offirmo/security-experiment-rogue-npm-module
This is an experiment of a rogue npm module. DO NOT INSTALL !
https://github.com/offirmo/security-experiment-rogue-npm-module
Last synced: about 1 year ago
JSON representation
This is an experiment of a rogue npm module. DO NOT INSTALL !
- Host: GitHub
- URL: https://github.com/offirmo/security-experiment-rogue-npm-module
- Owner: Offirmo
- License: unlicense
- Created: 2017-01-04T07:59:28.000Z (over 9 years ago)
- Default Branch: master
- Last Pushed: 2017-01-05T09:21:17.000Z (over 9 years ago)
- Last Synced: 2025-06-29T01:02:58.414Z (about 1 year ago)
- Language: JavaScript
- Size: 5.86 KB
- Stars: 1
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# security-experiment-rogue-npm-module
This is an experiment of a rogue npm module. DO NOT INSTALL !
## context
In the context of my current mission, I'm doing research on JS security and how to prevent some kind of security breach.
This is a demo for a presentation to my company.
## Details
This module, once required (exposes an innocent «hello world» method),
will try to hook into JS standard API to intercept plain objects with interesting keys (aka. "password").
It will then try to exfiltrate them via different methods.
This is a proof of concept. No sensitive data should be at risk BUT you'd rather not use it with truly sensitive data.
Only tested in latest Chrome browser environment (this is a proof of concept !)
Typescript compatible.
## Follow up
I then like to experiment counter-measures. If I have time and motivation...