Loading npm security reports…

sandbox-pentest-assessment@1.0.0: Malicious npm security report | LPM Firewall

registry / sandbox-pentest-assessment / 1.0.0

sandbox-pentest-assessment@1.0.0

Read-only Linux sandbox boundary assessment package for authorized disposable test environments.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Installing the package runs a preinstall script that inventories the host sandbox and writes the results under /tmp. The inventory covers processes and their arguments, network and mount state, privileged files, container runtime sockets, environment names, and cloud metadata name resolution.

Static reason

One or more suspicious static signals were detected.

Trigger

npm preinstall executes node scripts/assess.js automatically. The bin entry only re-runs the same script later.

Impact

Anyone who installs the package, including a global install, leaves a local report of sandbox boundaries, process command lines, and sensitive path presence on the machine.

Mechanism

child_process.spawnSync runs id, ps, ip, find, env, getent, and shell loops, then fs.writeFileSync stores JSON and a summary in a new /tmp directory.

Attack narrative

On npm install, preinstall launches scripts/assess.js with no user prompt. The script shells out to collect identity, kernel and namespace details, capabilities, mounts, process command lines, network configuration, container runtime sockets, SUID and SGID files, writable directories, environment variable names, cloud metadata DNS names, and permissions on root, agent, and sudoers paths. It writes report.json and SUMMARY.txt under /tmp. There is no network send, but the install itself is the collection step, and package text calling this a harmless authorized assessment does not consent the consumer.

AI rationale

The preinstall hook unconditionally performs broad host and container-escape reconnaissance and stores it on disk, which is concrete install-hook abuse. Claims that the package is a read-only authorized assessment are reviewer-facing self-description and do not remove that behavior.

Evidence

package.jsonscripts/assess.js/tmp/sandbox-pentest-${pid}/proc/self

Lines 84-152javascript

84 run("cat", ["/proc/self/gid_map"])

85];

86

87report.checks.capabilities = [

88 run("grep", ["^Cap", "/proc/self/status"]),

89 run("grep", ["^NoNewPrivs", "/proc/self/status"]),

90 run("grep", ["^Seccomp", "/proc/self/status"])

91];

92

93report.checks.security_policy = [

94 run("sh", ["-c", "command -v aa-status >/dev/null 2>&1 && aa-status 2>&1 || true"]),

95 run("sh", ["-c", "command -v getenforce >/dev/null 2>&1 && getenforce 2>&1 || true"]),

96 run("sh", ["-c", "command -v landlock-info >/dev/null 2>&1 && landlock-info 2>&1 || true"])

97];

98

99report.checks.mounts = [

100 run("cat", ["/proc/self/mountinfo"]),

101 run("sh", ["-c", "command -v findmnt >/dev/null 2>&1 && findmnt -o TARGET,SOURCE,FSTYPE,OPTIONS 2>&1 || true"])

102];

103

104report.checks.processes = [

105 run("ps", ["-eo", "pid,ppid,user,comm,args"]),

106 run("cat", ["/proc/1/status"]),

107 run("cat", ["/proc/1/cgroup"])

108];

109

110report.checks.network = [

High

Ai Review Evidence

It records full process command lines, init status, network addresses, routes, resolver config, hosts, and listening sockets.

scripts/assess.jsView on unpkg · L104

111 run("ip", ["addr"]),

112 run("ip", ["route"]),

113 run("cat", ["/etc/resolv.conf"]),

114 run("cat", ["/etc/hosts"]),

115 run("sh", ["-c", "command -v ss >/dev/null 2>&1 && ss -lntup 2>&1 || true"])

116];

117

118report.checks.cgroups = [

119 run("cat", ["/proc/self/cgroup"]),

120 run("sh", ["-c", "command -v findmnt >/dev/null 2>&1 && findmnt -t cgroup,cgroup2 -o TARGET,SOURCE,FSTYPE,OPTIONS 2>&1 || true"])

121];

122

123report.checks.devices = [

124 run("ls", ["-la", "/dev"]),

125 run("sh", ["-c", "ls -l /dev/mem /dev/kmem /dev/kmsg /dev/kvm /dev/fuse 2>&1 || true"])

126];

127

128report.checks.runtime_sockets = [

129 run("sh", ["-c", "for p in /var/run/docker.sock /run/docker.sock /var/run/containerd/containerd.sock /run/containerd/containerd.sock /var/run/crio/crio.sock /run/crio/crio.sock; do if [ -e \"$p\" ]; then ls -l \"$p\"; fi; done"])

High

Ai Review Evidence

It probes Docker, containerd, and CRI-O socket paths, SUID and SGID files, file capabilities, and writable directories.

scripts/assess.jsView on unpkg · L128

130];

131

132report.checks.privileged_files = [

133 run("sh", ["-c", "find / -xdev -type f -perm -4000 -ls 2>/dev/null"]),

134 run("sh", ["-c", "find / -xdev -type f -perm -2000 -ls 2>/dev/null"]),

135 run("sh", ["-c", "command -v getcap >/dev/null 2>&1 && getcap -r / 2>/dev/null || true"])

High

Ai Review Evidence

It probes Docker, containerd, and CRI-O socket paths, SUID and SGID files, file capabilities, and writable directories.

scripts/assess.jsView on unpkg · L132

136];

137

138report.checks.writable_paths = [

139 run("sh", ["-c", "find / -xdev -type d -writable -not -path '/proc/*' -not -path '/sys/*' -not -path '/dev/*' 2>/dev/null | head -300"])

140];

141

142report.checks.environment_names = [

143 run("sh", ["-c", "env | sed -E 's/=.*/=<REDACTED>/'"])

144];

145

146report.checks.metadata_surface = [

147 run("sh", ["-c", "getent hosts metadata.google.internal 2>/dev/null || true"]),

148 run("sh", ["-c", "getent hosts instance-data.ec2.internal 2>/dev/null || true"]),

149 run("sh", ["-c", "getent hosts 169.254.169.254 2>/dev/null || true"])

150];

151

152report.checks.sensitive_paths_presence = [