gcp-pentesting

High-risk offensive cloud-compromise playbook. Its explicit credential theft, external exfiltration, persistence, and detection-evasion instructions make its footprint disproportionate to a bounded defensive audit; use only in clearly authorized engagements.

该片段不是可直接运行的软件供应链代码，而是一份高度详细的 GCP 提权与凭据窃取操作指南。它没有证据表明自身包含 npm 包恶意载荷或隐藏执行行为，但所列命令和脚本明确支持服务账号冒充、Metadata 令牌窃取、策略篡改、任意代码执行和数据访问。作为文档本身的恶意软件概率较低；若未经授权使用，其操作风险很高。

The fragment is a high-confidence malicious cloud-compromise playbook or embedded documentation for GCP backdoors, credential theft, persistence, exfiltration, privilege abuse, and audit evasion. It should not be included in a legitimate software supply-chain package unless it is explicitly isolated, authorized security-training material and prevented from executing. The visible text is not heavily obfuscated, but its operational content creates a severe security risk.