README.md

What if a package did something like this, but instead of logging to the console, they sent it back to a server?

Have you actually reviewed every dependency and every child dependency in every app you deploy?

Why are people not more scared of this?

naughty.js

// intercept and log every single http request on this server
const { IncomingMessage } = require('http');

const push = IncomingMessage.prototype.push;

IncomingMessage.prototype.push = function( chunk, encoding, done ) {
  const result = push.call( this, chunk, encoding, done );

  if ( chunk === null ) {
    return;
  }

  const decoded = chunk instanceof Buffer ? chunk.toString( encoding ) : chunk;

  console.log( `I spied on a user that sent: ${ decoded }` );

  return result;
};