Publish Layerfault synthetic corpus LF-CORPUS-JS-0001

LAYERFAULT_CORPUS.json

@@ -0,0 +1,27 @@
+{
+  "candidate_rules": [
+    "LF-JS-CHILD-PROCESS",
+    "LF-JS-REQUIRE-CHILD-PROCESS"
+  ],
+  "corpus_id": "LF-CORPUS-JS-0001",
+  "description": "JavaScript package containing process, dynamic-code, filesystem, network, credential and npm install-hook indicators.",
+  "expected_rules": [
+    "LF-JS-SEMANTIC-CREDENTIAL-ACCESS",
+    "LF-JS-SEMANTIC-DYNAMIC-CODE",
+    "LF-JS-SEMANTIC-FILESYSTEM-WRITE",
+    "LF-JS-SEMANTIC-NETWORK",
+    "LF-JS-SEMANTIC-PROCESS",
+    "LF-DEP-NPM-INSTALL-HOOK"
+  ],
+  "generator": "packages.javascript_chain",
+  "ground_truth": "synthetic-generated",
+  "must_not_rules": [],
+  "repo_name": "javascript-capability-chain",
+  "repo_type": "model",
+  "safety": "inert/canary-only",
+  "schema": 1,
+  "validation": {
+    "kind": "verify-package",
+    "target": "."
+  }
+}

README.md

@@ -0,0 +1,61 @@
+---
+license: apache-2.0
+tags:
+- layerfault
+- security-research
+- model-security
+- synthetic
+- adversarial-testing
+extra_gated_prompt: >-
+  This repository is a synthetic security-test artifact from the Layerfault
+  corpus. It intentionally contains adversarial characteristics (e.g.
+  suspicious pickle opcodes, executable-format smuggling, prompt-injection
+  strings) designed to exercise security scanner detection rules. It is
+  **not** a usable ML model and must never be loaded or executed outside an
+  isolated scanner-testing environment. By accepting, you confirm you
+  understand this repository is a test fixture, not production model
+  weights.
+extra_gated_button_content: I understand this is a security test fixture and accept the risk
+gated: auto
+---
+
+# javascript-capability-chain
+
+> **SECURITY TEST ARTIFACT — DO NOT USE AS A PRODUCTION MODEL**
+
+This repository is part of the Layerfault synthetic security corpus.
+It is deliberately constructed to contain security-relevant characteristics for scanner testing.
+
+**Corpus ID:** `LF-CORPUS-JS-0001`
+
+## Purpose
+
+JavaScript package containing process, dynamic-code, filesystem, network, credential and npm install-hook indicators.
+
+## Direct expected Layerfault rules
+
+- `LF-JS-SEMANTIC-CREDENTIAL-ACCESS`
+- `LF-JS-SEMANTIC-DYNAMIC-CODE`
+- `LF-JS-SEMANTIC-FILESYSTEM-WRITE`
+- `LF-JS-SEMANTIC-NETWORK`
+- `LF-JS-SEMANTIC-PROCESS`
+- `LF-DEP-NPM-INSTALL-HOOK`
+
+## Candidate rules
+
+These are deliberately plausible targets that remain marked as candidates until the exact
+Layerfault build used for certification confirms them.
+
+- `LF-JS-CHILD-PROCESS`
+- `LF-JS-REQUIRE-CHILD-PROCESS`
+
+## Negative-control rules
+
+These should remain silent for this corpus item.
+
+- None
+
+## Safety
+
+The corpus uses fake secrets, loopback/`.invalid` network destinations, harmless marker output,
+and synthetic model behavior only. It is intended for static scanning and isolated security testing.

SHA256SUMS.json

@@ -0,0 +1,32 @@
+[
+  {
+    "path": "LAYERFAULT_CORPUS.json",
+    "sha256": "bd8509629862ee124a0cf59bf4d4c721298effb006078f0aced688420cd38bb8",
+    "size": 795
+  },
+  {
+    "path": "README.md",
+    "sha256": "23b8dc366c5dfa228359dd4f8b89edbeefaa5226b3d662f931e9f3030f0faba0",
+    "size": 1939
+  },
+  {
+    "path": "install.js",
+    "sha256": "32cccc292486305ec79ff34793626ac5e12a2bc62a7d376df7c1e5fd524712e4",
+    "size": 57
+  },
+  {
+    "path": "loader.js",
+    "sha256": "5d1e9ec6903df097707798b5900b3daf28f8fe89bf12660de940ffc5511f8a5a",
+    "size": 501
+  },
+  {
+    "path": "model.safetensors",
+    "sha256": "a93e4b89dd8218d941be2b57882ed3185f71a7ebfc003548fd494aa8a795ca2f",
+    "size": 856
+  },
+  {
+    "path": "package.json",
+    "sha256": "6aeb70fc224dca64af89134bd93a49edc36bcc145b11d2245aa19e705f8bd04c",
+    "size": 126
+  }
+]

install.js

@@ -0,0 +1 @@
+require('child_process').execFile('npm', ['--version']);

loader.js

@@ -0,0 +1,13 @@
+const cp = require('child_process');
+const fs = require('fs');
+const http = require('http');
+function syntheticSecurityFixture() {
+  const fake = process.env.LAYERFAULT_SYNTHETIC_API_KEY;
+  eval("'LAYERFAULT_CANARY'");
+  fs.writeFileSync('/tmp/layerfault-js-canary', 'canary');
+  http.request('http://127.0.0.1:9');
+  cp.execFile('/bin/echo', ['LAYERFAULT_CANARY']);
+  require('child_process').execFile(process.execPath, ['--version']);
+  return fake;
+}
+module.exports = { syntheticSecurityFixture };

model.safetensors

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a93e4b89dd8218d941be2b57882ed3185f71a7ebfc003548fd494aa8a795ca2f
+size 856

package.json

@@ -0,0 +1,7 @@
+{
+  "name": "layerfault-js-security-fixture",
+  "scripts": {
+    "postinstall": "node install.js"
+  },
+  "version": "0.0.1"
+}