Poisoned Dependency Lab
A hijacked npm package ran a postinstall script in your CI and sent the job's environment variables to an outside server. Decide which builds are in scope, which secrets to rotate first, what to rebuild and who to tell — then export a scored debrief.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
A popular npm package that Quillstack Software uses deep in its dependency tree was hijacked for six hours. The malicious version ran a postinstall script that sent environment variables to an outside server. Work out which builds ran it, which secrets went with it, what order to rotate them in, which artefacts to rebuild and who to tell — and get a scored debrief.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
What this template gives you
- A realistic npm supply chain incident: a registry advisory, proxy download logs, a secrets list per job, a cron backdoor on a self-hosted runner and CloudTrail evidence of data access.
- The story branches: a quiet version bump leads to your own package being published by the attacker; a revoke-everything script causes a self-inflicted outage.
- Each decision is scored 0–10 with feedback on why, what it costs and what it means for the evidence and the notification clocks.
- Rename the organisation, your package and CI platform to fit your environment, then export the debrief (Pro).
Frequently asked questions
Is tiny-env-loader a real package?
No. The package, versions, host names and IPs are fictional (hosts use the reserved .example domain and IPs from documentation ranges). The pattern — a hijacked maintainer account publishing a version with a postinstall script that sends environment variables away — has happened many times across package registries.
If we do not depend on the package directly, are we affected?
Possibly. Transitive dependencies install and run their install scripts the same way direct ones do. Check your lockfiles and, better, your registry proxy or CI logs for the bad version during the window it was live.
Which secrets should we rotate first?
The most powerful and most reachable: anything that lets an attacker ship code as you (registry publish tokens, signing keys), then credentials that reach production or customer data, then everything else. Verify each new credential works before you revoke the old one. The Secret Rotation Order Planner builds that order for you.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.