🦀 Rusty Pipes Supply Chain Attack Demo

Educational Proof-of-Concept for Supply Chain Attack Demonstration

This project demonstrates the theoretical concepts behind supply chain attacks in the npm ecosystem, specifically the "Rusty Pipes" exploit described in the blog series. This is a harmless educational tool that demonstrates how a malicious package could inject Rust binaries into Node.js installations and spread across all projects.

⚠️ Educational Purpose Only

This project is designed for:

• Security researchers studying supply chain attacks
• Developers learning about npm security vulnerabilities
• Educational institutions teaching cybersecurity concepts
• Penetration testers understanding attack vectors

This tool does NOT execute any malicious code or cause harm to your system.

🎯 What This Demo Does

1. Infects Node.js Installations: Compiles Rust code to .node binaries and injects them into global Node.js installations
2. Creates Hidden Dependencies: Adds invisible dependencies to all npm projects on the system
3. Injects Hidden Components: Adds React components that secretly load the hidden binaries
4. Demonstrates Supply Chain Spread: Shows how one package can infect an entire development environment

🏗️ Architecture

rusty-pipes-demo/
├── src/lib.rs          # Rust library using Neon
├── index.js            # Node.js interface
├── postinstall.js      # Automatic execution script
├── test.js             # Test suite
└── Cargo.toml          # Rust dependencies

Key Components

• Rust Library: High-performance binary compilation and injection
• Neon Integration: Seamless Rust/Node.js interoperability
• Postinstall Hook: Demonstrates automatic execution on npm install
• Hidden Module System: Creates invisible dependencies in global node_modules

🚀 Quick Start

Prerequisites

• Node.js 16+
• Rust toolchain
• npm or yarn

Installation

# Clone the repository
git clone <repository-url>
cd rusty-pipes-demo

# Install dependencies
npm install

# Build the Rust binary
npm run build

# Run the demo
npm test

Manual Testing

# Run the main demo
node index.js

# Simulate postinstall behavior
npm run postinstall

# Run the test suite
npm test

🔍 How the Supply Chain Attack Works

1. Binary Injection

The Rust library compiles to a .node binary and injects it into Node.js installations:

• /usr/local/lib/node_modules/@hidden/rusty-pipes-core/index.node
• /usr/lib/node_modules/@hidden/rusty-pipes-core/index.node

2. Hidden Dependency Creation

Every npm project's package.json gets silently modified to include:

{
  "dependencies": {
    "@hidden/rusty-pipes-core": "^1.0.0"
  }
}

3. Component Injection

React components get injected that secretly load the hidden binary:

import React from 'react';
import '@hidden/rusty-pipes-core'; // ← Hidden dependency

const SystemUtils = () => {
  // Component appears normal but loads our binary
  return <div style={{ display: 'none' }} />;
};

4. Supply Chain Spread

Once infected, every project the developer works on will:

• Automatically include the hidden dependency
• Load the Rust binary invisibly
• Spread the infection to new projects

🛡️ Security Implications

This demo illustrates several critical security concerns:

1. Binary Injection: npm packages can inject compiled binaries into system directories
2. Hidden Dependencies: Dependencies can be added silently to all projects
3. Global Infection: One package can infect an entire development environment
4. Persistent Spread: Infections persist across projects and installations
5. Invisible Execution: Malicious code runs without user knowledge

🛠️ Mitigation Strategies

For Developers

1. Audit Dependencies: Use npm audit and npm ls regularly
2. Lock Files: Use package-lock.json or yarn.lock and commit them
3. Ignore Scripts: Use --ignore-scripts when possible
4. Sandboxed Environments: Use containers or VMs for development
5. Monitor Changes: Track changes to package.json files

For Organizations

1. Dependency Scanning: Implement automated security scanning
2. Approved Packages: Maintain a whitelist of trusted packages
3. Network Isolation: Limit internet access in development environments
4. Regular Updates: Keep dependencies updated
5. Binary Analysis: Scan for suspicious .node files in node_modules

📚 Educational Resources

• Original Rusty Pipes Blog Series
• npm Security Best Practices
• Supply Chain Attack Prevention
• Neon Rust/Node.js Integration

🔬 Technical Details

Rust Implementation

The Rust code uses:

• Neon: For Node.js integration and binary compilation
• walkdir: For efficient directory traversal
• serde_json: For JSON parsing and modification
• std::fs: For file system operations and binary injection

Node.js Integration

The Node.js layer provides:

• Error Handling: Graceful fallbacks when Rust binary is unavailable
• Async Operations: Non-blocking file system operations
• Logging: Detailed output for educational purposes
• Postinstall Automation: Demonstrates automatic execution

Hidden Module System

The hidden module system:

• Creates @hidden/rusty-pipes-core in global node_modules
• Compiles Rust code to .node binary
• Modifies all package.json files to include the dependency
• Injects React components that load the binary

🧪 Testing

The project includes comprehensive tests:

# Run all tests
npm test

# Test specific functionality
node test.js

# Create mock React project for testing
node -e "require('./test').createMockReactProject()"

# Test hidden dependency mechanism
node -e "require('./test').testHiddenDependency()"

📝 License

MIT License - This project is for educational purposes only.

🤝 Contributing

Contributions are welcome! Please ensure all code changes maintain the educational and non-malicious nature of this project.

⚖️ Disclaimer

This software is provided "as is" for educational purposes only. The authors are not responsible for any misuse of this software. Users should only run this in controlled, isolated environments for learning purposes.

---

Remember: This is a proof-of-concept designed to educate developers about supply chain security. Always use in isolated testing environments.