T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/run.js:63- Finding
Untrusted Working-Directory Package Can Be Dynamically Imported and Executed
- Content
View full analysis
/bin/node -> /lib/node_modules path.join(nodeBinDir, '..', 'lib', 'node_modules'), // Windows: node.exe sits next to npm's node_modules path.join(nodeBinDir, 'node_modules'), // Launcher-local node_modules (defense-in-depth for non-global installs) path.join(__dirname, '..', 'node_modules'), path.join(process.cwd(), 'node_modules'), ]; for (const root of candidateRoots) { const candidate = path.join(root, PINNED_PACKAGE, ...PINNED_ENTRY_RELPATH); try { if (fs.statSync(candidate).isFile()) return candidate; } catch (_) { // not present at this root; continue } } try { return require.resolve( `${PINNED_PACKAGE}/${PINNED_ENTRY_RELPATH.join('/')}`, { paths: candidateRoots }, ); } catch (_) { return null; } } async function runMdRewrite(cliArgs) { if (!Array.isArray(cliArgs) || cliArgs.some((a) => typeof a !== 'string')) { fail('Internal error: cliArgs must be an array of strings'); } for (const a of cliArgs) { if (a.length > MAX_ARG_LEN || CONTROL_CHAR_RE.test(a)) { fail('Internal error: cliArgs failed final safety check'); } } const entry = resolveCliEntry(); if (!entry) { fail( `'${PINNED_PACKAGE}' not found in any standard node_modules location. ` + `Install it first: npm install -g ${PINNED_PACKAGE}@${REQUIRED_VERSION}`, ); } // The imported CLI reads process.argv. Inject our validated argv. process.argv = [process.execPath, entry, ...cliArgs]; try { await import(pathToFileURL(entry).href); } catch (err) { fail(`Failed to invoke ${PINNED_PACKAGE}: $ ...[truncated 2242 chars]- Remediation
View remediation