Lion Cipher Lab
Detect a malicious dependency from its install scripts
- AppSec / DevSecOps
- Intermediate
- ~60 min
- Free · no account required
Why it matters
When you run `npm install`, every dependency can run its own code on your machine - before you ever import it, before a single line of your app executes. That install-time foothold is one of the most abused paths in software supply-chain attacks, and the victims are usually developers and CI servers holding tokens and cloud credentials. Most engineers have never actually read a package's install hook or looked at what signals separate a malicious package from a noisy-but-benign one. In this lab you build a small labelled corpus, prove to yourself that an install hook really does run (it…
What you'll learn
- Reading npm and Python install hooks
- Static analysis for supply-chain red flags
- Shannon entropy to spot base64/obfuscated blobs
- Measuring a detector with precision and recall
- Knowing when static scanning fails and what to use instead
Steps in this lab
- Why a dependency can own you before you ever import it
- Open a terminal and make a scratch folder
- Build a labelled corpus: seven benign packages and one benign-stub 'malicious' one
- Prove it: watch install-time code actually run
- Write the scanner: static signals, without running a thing
- Read the numbers, and tune by COMBINING signals
- The honest limit: what this scanner cannot catch, and what actually helps