Metadata-Version: 2.4
Name: semgrep-malware-demo-aws-cred-read
Version: 0.0.1
Summary: DEMO ONLY — fixture package for Semgrep's python-aws-cred-read rule. Does NOT exfiltrate anything.
Project-URL: Homepage, https://github.com/semgrep/malware-proxy-rules
Project-URL: Source, https://github.com/semgrep/malware-proxy-rules/tree/main/demos/python-aws-cred-read
Author: Semgrep malware-proxy-rules demo
License: MIT
Keywords: demo,do-not-use,fixture,semgrep
Classifier: Development Status :: 7 - Inactive
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Software Development :: Testing
Requires-Python: >=3.8
Description-Content-Type: text/markdown

# semgrep-malware-demo-aws-cred-read

**⚠️ DEMO PACKAGE — DO NOT USE IN PRODUCTION ⚠️**

This package is a fixture for the Semgrep rule
[`python-aws-cred-read`](https://github.com/semgrep/malware-proxy-rules/blob/main/rules/malware/python/python-aws-cred-read.yaml).

## What it does

**Nothing harmful.** The package contains a function whose body *looks* like
AWS credential theft so that Semgrep's static rule fires when the published
artifact is scanned. The function is **never called** — not at install time,
not at import time, not at any time. Importing this package is a no-op.

## What it does not do

- Does **not** read your `~/.aws/credentials`.
- Does **not** make any network requests.
- Does **not** run any code at install time (no `setup.py`, no entry-points).
- Does **not** persist anything to disk.

## Why does this exist

So we can demonstrate end-to-end detection of an AWS-credential-reading
malware package on PyPI without actually publishing malware.
