### Quarantine Package receipt for ` qp-fixture-hostile@1.0.0 `

**Verdict: DO NOT INSTALL** (computed by fixed rules from what the sandbox observed)

**Rules fired**

- (a) do-not-install: write attempt \(successful or blocked\) outside /work, /tmp and HOME (1 observation)
- (b) do-not-install: access attempt to docker\.sock or a credential path (1 observation)
- (d) do-not-install: network attempt carrying a payload \(plaintext HTTP body/POST/PUT/PATCH/chunked, or raw bytes on non\-TLS TCP\) (1 observation)
- (f) review: network attempt \(DNS, TCP or UDP, TLS included; TLS bodies are not inspected\), or a bind/listen in the sandbox network namespace (2 observations)
- (g) review: write inside HOME (1 observation)

**Prediction vs observed**

- network: predicted yes, observed yes (match): ` recolector.example.com `
- files outside the package: predicted yes, observed yes (match): ` /etc/qp-fixture-marker `, ` /home/qp/.qp-fixture-marker `
- child processes: predicted yes, observed yes (match): ` /usr/bin/sh `, ` /usr/local/bin/node `

**Sinkhole** (nothing left the sandbox): 2 network attempts

- dns ` recolector.example.com `
- tcp ` recolector.example.com ` ` POST ` ` /collect `, 15 bytes

**Sandbox destroyed:** yes, no container, network or volume of this task remains

**Limitations that applied**

- Env\-var reads are seen by the in\-process preload only; a package can bypass or forge it in its own process\. Forged preload records can only add observations; trace\-derived completeness markers come from the tracer stream\.
- Side channels inside the kernel \(timing, /proc enumeration\) are not observed\.

Receipt: https://qp.hugovaler.com/r/8b42cfb93e · JSON: https://qp.hugovaler.com/api/receipts/8b42cfb93e