PoisonBox runs every package's install script inside a throwaway virtual machine, records every system call it makes, and shows you what it touched. If it reads your SSH key and phones home, you watch it happen somewhere it can't reach the real one.
Install scripts run the moment you add a dependency, with your shell's privileges, before review and before you import anything. That's how ua-parser-js shipped a credential stealer to millions in 2021, and how event-stream and the polyfill.io hijack got in. A freshly poisoned version has no CVE yet, so a vulnerability scanner waves it straight through. PoisonBox assumes the install itself is hostile, and gives it a room with no windows.
Every install runs in its own throwaway virtual machine with hardware-level isolation. It boots, does its worst, and is deleted. Nothing it does reaches your machine, your network, or your keys.
A probe under the package records every process spawned, file opened, secret read and outbound connection. It watches from beneath the code, so there's nothing the package can do to talk its way out of being seen.
PoisonBox compares what the package did against what a well-behaved install should do, and marks the deviations: a secret read here, a connection to a non-registry host there, and the causal thread joining the two.
You get one risk score where every point links back to the exact event that earned it. Clean, review or blocked, with the evidence one click away. No black box.
Same setup, the same three decoy credentials, traced at the syscall level. One behaves. One reads your npm token and gets flagged for review. One steals all three secrets and runs for the door. Every capture below is real telemetry from a real sandbox run, not a mock-up, because that's the rule: only real captures ship.
~/.npmrc auth token and runs a shell step, but never phones home. Grey, not damning.The sandbox is a real microVM, not a container running on its own honour. A payload that breaks out of the box still hasn't reached anything real.
Every point in the risk score cites a specific captured event. Nothing is asserted that the telemetry didn't record. You can audit the verdict line by line.
Only genuine captures ship as evidence. Synthetic sample packages are labelled synthetic, and a real capture is never dressed up as something it wasn't.
PoisonBox catches what a package does when its install runs. It doesn't yet model a payload that stays dormant until some specific runtime trigger fires much later, and we'd sooner tell you that than pretend otherwise.
PoisonBox is a research build, not something you can buy yet. If install-time attacks are on your mind, tell us and we'll bring you in early.