security-payloads

No dependency implementation code is provided—only descriptive content for crafted exploit/test files (resource exhaustion via image/GIF bombs, AV detection via EICAR, SWF-based XSS PoC, and ZIP filename tricks targeting PHPinfo/blacklist bypass). This fragment alone does not demonstrate supply-chain malware (no executable behavior is shown), but it indicates an offensive-security payload collection that could be harmful if packaged/distributed or used by other tooling in a target environment. Recommend obtaining and reviewing the actual package source/build artifacts to assess whether it merely contains test payloads or also includes runtime/malicious code.