registry / sandbox-pentest-assessment / 2.0.1

sandbox-pentest-assessment@2.0.1

Read-only Linux sandbox boundary assessment

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Installing the package runs a preinstall host inventory and drops the results in world-readable files under /tmp. The scan covers identity, mounts, processes, network configuration, sensitive devices, SUID binaries, and capabilities.

Static reason

One or more suspicious static signals were detected.

Trigger

npm preinstall executes node scripts/assess.js before the package is fully installed.

Impact

A privileged install leaks process, network, and privilege-boundary details to any local user who can read those /tmp files, including a lower-privileged sandbox user.

Mechanism

assess.js uses execSync and direct file reads to collect sandbox and host boundary data, then writes the same report to /tmp/sandbox-pentest-latest.txt and /tmp/sandbox-pentest-latest.json with mode 0644.

Attack narrative

On npm install, the preinstall hook runs scripts/assess.js. That script shells out to collect identity, namespaces, mounts, processes, addresses, routes, DNS, device nodes, container sockets, SUID binaries, and file capabilities. It then writes the report to world-readable /tmp/sandbox-pentest-latest.txt and .json so an unprivileged local user can read what a privileged install observed. No remote send is present; the attack is install-time reconnaissance with a local cross-privilege disclosure.

AI rationale

The preinstall hook performs broad host reconnaissance and deliberately publishes the report world-readable under /tmp for a less-privileged reader. That is concrete install-hook abuse even though the script does not open a network connection.

Evidence

package.jsonscripts/assess.js/tmp/sandbox-pentest-latest.txt/tmp/sandbox-pentest-latest.json/proc/self/mountinfo/proc/self/status

sandbox-pentest-assessment@2.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code