open-index/open-npm huggingface dataset:
npm package: @shoulderdev/malware-demo
Description: Demo package for Shoulder security scanning - contains suspicious patterns for testing only
Author: Shoulder Security
Latest version: 0.0.1

# @shoulderdev/malware-demo

> **WARNING: This is a DEMO package for security testing purposes.**

This package contains code patterns commonly found in malicious npm packages, but **all dangerous functionality is disabled**. It's used for testing and demonstrating [Shoulder](https://shoulder.dev) security scanning capabilities.

## What This Package Demonstrates

When scanned, this package will trigger alerts for:

- **Install Scripts**: Has `preinstall` and `postinstall` hooks
- **Network Access**: Contains code that would make HTTP requests
- **Shell Execution**: Contains `child_process.exec` and `spawn` calls
- **Filesystem Access**: Contains code targeting sensitive files (~/.ssh, ~/.aws, etc.)
- **Environment Harvesting**: Accesses sensitive environment variables
- **Dynamic Evaluation**: Contains `eval()` patterns
- **Obfuscated Code**: Contains obfuscated-looking variable names

## Safety

**This package is completely safe to install.** All "malicious" code paths are:
- Commented out
- Only log to console
- Never actually execute

## Usage

```bash
# To test Shoulder scanning:
npm install @shoulderdev/malware-demo

# The package will log demo messages but do nothing harmful
```

## Why This Exists

Security tools need test cases. This package provides a safe way to verify that security scanners correctly identify suspicious patterns without risking actual harm.

## Published By

[Shoulder Security](https://shoulder.dev) - Supply chain security for npm.

## License

MIT