semgrep-malware-demo-aws-cred-read 0.0.1

DEMO ONLY — fixture package for Semgrep's python-aws-cred-read rule. Does NOT exfiltrate anything.

semgrep-malware-demo-aws-cred-read

⚠️ DEMO PACKAGE — DO NOT USE IN PRODUCTION ⚠️

This package is a fixture for the Semgrep rule python-aws-cred-read.

What it does

Nothing harmful. The package contains a function whose body looks like AWS credential theft so that Semgrep's static rule fires when the published artifact is scanned. The function is never called — not at install time, not at import time, not at any time. Importing this package is a no-op.

What it does not do

• Does not read your ~/.aws/credentials.
• Does not make any network requests.
• Does not run any code at install time (no setup.py, no entry-points).
• Does not persist anything to disk.

Why does this exist

So we can demonstrate end-to-end detection of an AWS-credential-reading malware package on PyPI without actually publishing malware.