supply-chain-attack

High-risk offensive security skill focused on supply-chain compromise, CI/CD abuse, credential theft, and exfiltration. Its capabilities match its stated purpose, but that purpose is to enable attacks against third-party targets, making the skill dangerous and unsuitable for normal developer-assistance use.

该片段是包含攻击性 CI/CD 示例的安全教育或威胁建模材料，不是已确认的运行时恶意代码。若其中的 Jenkinsfile 或命令被复制到真实环境并执行，可能导致凭据外传、远程代码执行、反向 shell 和供应链投毒。当前可见内容没有独立执行这些操作的机制，因此包级恶意行为判断为低，但示例代码本身的潜在安全影响很高。

The fragment contains deliberate install-time DNS callbacks that transmit package and system identity data to an external domain. This is a supply-chain telemetry/exfiltration mechanism and is inappropriate for a normal dependency, even if presented as authorized red-team research. No destructive payload is visible, but the dependency-confusion framing, automatic lifecycle execution, external callback, and host/user disclosure make the code dangerous to install without explicit authorization and isolation.