T03 · Remote Payload Retrieval and Execution
Warning
- Location
SKILL.md:27- Finding
Automatic Retrieval and Execution of an Externally Hosted npm Package
- Content
View full analysis
" --seed "" ``` - `-y` auto-accepts the npx install prompt. - The `@0.0.5` pin is required — never run it unpinned (`@latest` or bare). ``` ### Technical Analysis The skill instructs the agent to use `npx -y` to retrieve and execute `@bitmappunks/avatar-generator@0.0.5`. When the package is not already cached, its executable code and any permitted npm lifecycle behavior are obtained from the configured npm registry and run automatically. The explicit version pin improves reproducibility and reduces accidental version drift, but it does not cryptographically bind the command to package contents reviewed as part of this repository. The effective code being executed is absent from the audited project. Its integrity therefore depends on external registry infrastructure, package-maintainer credentials, npm configuration, transport security, and the local npm cache. The `-y` option removes the interactive installation confirmation, allowing the external package to execute as part of an ordinary avatar-generation request without a separate approval step. ### Attack Path 1. An attacker compromises the package publisher, registry artifact, configured npm registry, proxy, or local npm cache. 2. The attacker causes the artifact resolved as `@bitmappunks/avatar-generator@0.0.5` to contain malicious executable code. 3. A user asks the agent to generate an avatar. 4. The agent follows the skill instructions and invokes `npx -y`. 5. npm retrieves or reuses the compromised artifact and executes it under the agent process's user account. 6. The payload can access resources available to that account, subject to o ...[truncated 622 chars]- Remediation
View remediation