Fake Security Scanner Repo: postinstall Hooks and Exfil Endpoints
A repo-level teardown of a fake GitHub "security scanner" that chains a postinstall hook, an obfuscated loader, and an exfiltration endpoint into a developer-targeted backdoor. The video walks the chain in the order it fires: the facade that gets you to clone, the install hook that runs with your shell environment, the loader that hides where data goes, and the request that moves it off the machine. Then it covers the controls that actually break each link, including install-script settings and the pnpm 10 default that keeps dependency lifecycle scripts off until you allowlist them. All code shown is a defanged local fixture built to illustrate the mechanics. It is not a sample from any campaign; the source material contains no repository names, package names, hashes, or version ranges, so none are claimed here. Key points: - git clone runs nothing, but opening the cloned folder in an editor can, via checked-in workspace tasks. - npm install is where install-time code runs, before your tests, linter, or review sees it. - --ignore-scripts narrows the window; it does not stop runtime code in the entry point or a bin you invoke yourself. - Comparing registry publish dates with the repo's first commit exposes history that does not match the artifact. Full write-up: https://hackyjs.com/posts/dissecting-a-fake-security-scanner-repo-postinstall-hooks-obfuscated-loaders-and-exfil-endpoints