A deliberately vulnerable package registry
An npm-style package registry with attack scenarios baked in, so people learning supply chain security can practice detection against realistic targets.
Why build this
Most people learning software supply chain security have to imagine what a compromised registry looks like. There’s DVWA for web app vulnerabilities, HackTheBox for network security, but nothing equivalent for supply chain. If you want to practice detecting a typosquat or a dependency confusion attack, you have to build the target yourself before you can practice against it.
What it will include
- A functional package registry with the usual npm-style shape (search, install, versions, metadata)
- Attack scenarios pre-seeded: typosquats, dependency confusion, malicious postinstall scripts, protestware
- A “detection mode” that lets learners run scanners against the registry and see what they find (and miss)
- Writeups explaining each scenario, so it’s a curriculum as much as a lab
Status
Design phase. Stack not chosen yet — the top question is whether to build on an existing registry implementation (Verdaccio, sonatype-nexus) or write something purpose-built for teaching. Follow along in the garden as I decide.