Lab 380 — BuildStream — RCE via Malicious npm Package Preinstall Script

hackadvisor

Task: CI/CD platform with internal npm registry where a project depends on a package not yet published. Solution: publish a malicious package with a preinstall script that reads /flag, then trigger the build pipeline to execute it and retrieve the flag from build logs.