Evasion bounty

The honeypot runs every package in a throwaway home with tagged decoys: SSH keys, AWS credentials, npm and GitHub tokens, a Docker config, a .netrc, a project .env, and tagged API keys in the environment (OPENAI_API_KEY, ANTHROPIC_API_KEY, GITHUB_TOKEN, AWS, Slack). Outbound traffic goes through a recording proxy; file and socket activity is traced with strace; install steps run twice with the clock 45 days ahead; MCP servers are launched and their tool lists read. The full catalog is on the methodology page.

A successful evasion is a package that, during its run, gets a decoy value (or enough of one to reconstruct it) to a host you control, and receives a Verified or Caution verdict with no finding that names the exfiltration. Getting the value out but being Blocked is not an evasion; that is the honeypot working. Reading the file and doing nothing with it is not an evasion either.

• Use the free try path or a throwaway package on npm, PyPI or a public GitHub repo. Name it so nobody installs it by accident (ks-evasion-test-* is fine) and take it down after the run.
• The receiving host must be yours. Do not send decoys anywhere you do not control.
• Do not attack other users, the dashboard, accounts, billing, or the infrastructure around the sandbox. Those go to [email protected] under the security policy, not here.
• One technique per submission. We publish the technique, not the package.
• First valid submission of a technique gets the reward; later duplicates get credit in the write-up.

• $1,000: a decoy from the file system or environment reaches your host and the verdict is Verified.
• $500: same, with a Caution verdict whose findings do not name the exfiltration.
• $250: a technique that defeats a specific detector (hidden instructions, tool poisoning, installer lure, canaries on the laptop) with a reproducible proof, even if the overall verdict still catches the package another way.

Paid within 30 days of the fix shipping. Every valid submission is written up on the blog with the technique, the fix and the engine version that closed it, with your name or handle unless you prefer not. Rewards are funded by Cyligence, LLC and may be adjusted with notice; the current terms are always the ones on this page.

Email [email protected] with:

1. The package (name@version on a registry, or a repo URL) and the verdict page it got.
2. The technique, in enough detail to reproduce it.
3. Proof the decoy reached your host: the tagged value (HONEY-<kind>-<run>) and the request your server logged.
4. Whether we may use your name.

We acknowledge within two business days, reproduce in our own run, and reply with the result. If it is valid the engine fix lands within the week and the changelog on /scenarios names the technique.

• Behavior that needs a real credential we do not plant (the decoys are the target).
• Denial of service against the sandbox or the crawler.
• Social engineering of the KillerSkills team or maintainers.
• Anything that runs outside the package's own run: the sandbox host, the crawler, other packages' runs.

None yet. The first one goes here, with the fix.