Security PoC placeholder (dependency-confusion / scope-takeover demonstration) - benign, no runtime payload. Uploaded by yash_005 for authorized security research.

Security PoC placeholder (dependency-confusion / scope-takeover demonstration) - benign, no runtime payload. Uploaded by yash_005 for authorized security research.

authz-test probe (benign)

authz-test probe (benign)

Benign npm lifecycle canary for authorized Figma Make security testing

authz-test probe (benign)

Contains benign pre and postinstall scripts to enable safe testing of lifecycle script settings in Node, Bun and Deno

Prompt injection detection for AI applications. Lightweight regex-based engine with weighted scoring, benign-context dampening, and zero dependencies.

Benign post-install canary package for testing sandbox protections against supply chain attacks

A benign package to test various npm security heuristic scanners

Mock feed data for supply-chain demo (benign).

AxioRank agent red-team corpus: a versioned library of attack scenarios (secrets, injection, destructive ops, kill chains) plus benign controls. Pure data, zero runtime dependencies.

Very old version of hull.js with backported security fixes -- do not use in new projects

Benign dependency-confusion canary for Toast Intigriti VDP F001. Demonstrates install-time code execution path. Source: see Intigriti report. NO data exfil, NO network calls, NO destructive ops — only console output + a marker file in /tmp.

Dependency confusion security test placeholder. Does not collect data.

The Glitch word list, packaged into an NPM module for easy use.

A small demo app to show how supply chain attacks may be used

Safe MCP server demo - benign tools with no attack patterns, for comparison testing

Paperclip adapter for Hermes Agent — run Hermes as a managed employee in a Paperclip company

Paperclip adapters for Hermes Agent local CLI and Hermes Gateway HTTP/SSE runs