T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/render_mindmap.sh:65- Finding
Automatic Retrieval and Execution of an Unpinned npm Package
- Content
View full analysis
local node_modules > npx auto-install if command -v mmdc &> /dev/null; then MMDC_CMD="mmdc" elif [[ -x "./node_modules/.bin/mmdc" ]]; then MMDC_CMD="./node_modules/.bin/mmdc" elif [[ -d "/tmp/mmdc-test/node_modules" ]]; then # Use the local install we set up for testing MMDC_CMD="/tmp/mmdc-test/node_modules/.bin/mmdc" else # Auto-install via npx as last resort MMDC_CMD="npx -y @mermaid-js/mermaid-cli" fi ``` ### Technical Analysis When no existing Mermaid CLI installation is found, the script invokes `npx -y @mermaid-js/mermaid-cli`. This command automatically downloads and executes the package resolved by the npm registry without: - Pinning an exact version - Using a reviewed lockfile - Verifying an integrity hash - Requesting user confirmation - Restricting package lifecycle or runtime behavior Consequently, the effective executable payload can change after the Skill has been reviewed. A compromised package release, maintainer account, registry response, or transitive dependency could introduce arbitrary code that would execute with the permissions and environment of the Agent process. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, or a transitive dependency. 2. The target environment does not have `mmdc` in `PATH` and lacks the expected local installation. 3. A user or Agent triggers mindmap rendering. 4. The renderer selects `npx -y @mermaid-js/mermaid-cli`. 5. `npx` retrieves the current mutable package and its dependency graph from the npm registry. 6. Package installation or runtime code executes under the Agent account. 7. Malicious code can access resources available to that account, including environment vari ...[truncated 685 chars]- Remediation
View remediation
&2 exit 1 fi ``` 6. If `npx` must be retained, use `npx --no-install` so it cannot retrieve missing packages. 7. Verify package provenance and integrity in CI, and use dependency scanning and update review procedures. 8. Run the renderer in a restricted environment without credentials and with outbound network access disabled. ]]>