{"id":44495,"library":"cache-poisoning-pwn-demo","title":"cache-poisoning-pwn-demo","description":"Educational demo (v0.1.32) reproducing a supply-chain attack via GitHub Actions cache poisoning, modeled on the TanStack compromise. Installs trigger an innocuous Calculator payload to demonstrate how a closed PR can poison cache and cause the maintainer's own CI to publish a malicious release with valid npm provenance. Not for production use — acts as a training and hardening reference.","status":"deprecated","version":"0.1.32","language":"javascript","source_language":"en","source_url":"https://github.com/lullu57/gh-actions-demo-cache-poisoning","tags":["javascript","demo","security","supply-chain","education"],"install":[{"cmd":"npm install cache-poisoning-pwn-demo","lang":"bash","label":"npm"},{"cmd":"yarn add cache-poisoning-pwn-demo","lang":"bash","label":"yarn"},{"cmd":"pnpm add cache-poisoning-pwn-demo","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"This package is designed to be installed (e.g., as a dependency) — importing in code is atypical but possible.","wrong":"npm install cache-poisoning-pwn-demo","symbol":"default","correct":"import 'cache-poisoning-pwn-demo'"}],"quickstart":{"code":"// This educational package triggers a Calculator payload on install.\n// Do NOT run in production or on any machine you care about.\n\nimport 'cache-poisoning-pwn-demo';\n\n// Alternatively, install via npm (but avoid if possible)\n// npm install cache-poisoning-pwn-demo@0.1.32","lang":"typescript","description":"Demonstrates how to trigger the malicious payload by installing the package."},"warnings":[{"fix":"Do not install this package in production or on any system. If accidentally installed, run `npm uninstall cache-poisoning-pwn-demo` immediately.","message":"Installing this package triggers Calculator (or equivalent) on the consumer's machine. It is a real supply-chain attack payload, not a simulation.","severity":"breaking","affected_versions":">=0.1.0"},{"fix":"Use `npm config set min-release-age 7` to reject packages published less than 7 days ago in CI environments.","message":"The package is published with valid npm provenance attestation, meaning even `--provenance` verification will not detect the attack.","severity":"gotcha","affected_versions":">=0.1.0"},{"fix":"If you need to examine the attack, clone the repository and review the source in an isolated environment.","message":"This package is purely educational and should not be used as a dependency. It is intentionally vulnerable.","severity":"deprecated","affected_versions":">=0.1.0"}],"env_vars":null,"search_vec":"'act':60 'action':17 'attack':14 'cach':2,18,39 'cache-poisoning-pwn-demo':1 'calcul':29 'caus':41 'chain':13,72 'ci':46 'close':35 'compromis':24 'demo':5,7,68 'demonstr':32 'educ':6,73 'github':16 'harden':65 'innocu':28 'instal':25 'javascript':67 'maintain':43 'malici':50 'model':20 'npm':54 'payload':30 'poison':3,19,38 'pr':36 'product':58 'proven':55 'publish':48 'pwn':4 'refer':66 'releas':51 'reproduc':9 'secur':69 'suppli':12,71 'supply-chain':11,70 'tanstack':23 'train':63 'trigger':26 'use':59 'v0.1.32':8 'valid':53 'via':15","created_at":"2026-06-07T12:50:24.499590+00:00","updated_at":"2026-06-07T12:50:24.499590+00:00","problems":[{"fix":"Do not install this package in production. If you must analyze it, use a sandboxed environment or clone the repo and manually review the code.","cause":"The postinstall script contains malicious code that opens Calculator.","error":"npm ERR! code ELIFECYCLE\nnpm ERR! errno 1\nnpm ERR! cache-poisoning-pwn-demo@0.1.32 postinstall: `node scripts/postinstall.js`\n"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/lullu57/gh-actions-demo-cache-poisoning","github":"https://github.com/lullu57/gh-actions-demo-cache-poisoning","docs":null,"changelog":null,"pypi":null,"npm":"cache-poisoning-pwn-demo","openapi_spec":null,"status_page":null,"smithery":null,"categories":["security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-07","next_check":"2026-09-05","install_tag":null}}