Supply Chain Lark Apaas Miaoda Sandbox Skills Package Deployment
This rule watches for a particular npm package, @lark-apaas/coding-miaoda-sandbox-skills, being installed, updated, or unpacked into an AI agent's sandbox. If an attacker publishes a poisoned version of that package to npm, the sandbox's normal skill-sync process would pull it in and run it inside the agent's own execution context.
How the attack works
An agent sandbox periodically synchronises its 'skills' by pulling packages from npm, including this one. An attacker who compromises or republishes this package on npm can plant malicious code or lifecycle scripts inside the tarball. When the sandbox's update-skills step installs or links the package, the tampered files land under .agent/skills and any scripts inside execute with the agent's own privileges. The rule catches this by looking for the package name combined with an install/update/link/unpack/sync command, and ignores read-only commands like npm view or --dry-run that just mention the package.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4b7c9e21-3a5f-4d18-9c6e-2f8a1d4b7e30
- Severity
- Medium
Why it matters
A poisoned skill package would let an attacker run arbitrary code inside the agent's sandbox and context, potentially affecting anything the agent can access or act on. The rule only flags the installation step of the package manager — it does not confirm the package content is malicious or observe file writes into .agent/skills directly.
What you can do
- →Pin the package to a known-good version and hash in your lockfile, and verify integrity fields before any sync step runs.
- →Whenever this fires, check the resolved version and package integrity against your lockfile rather than assuming compromise.
- →Restrict which npm registries and packages agent sandboxes are allowed to pull from during skill synchronisation.
- →Review lifecycle scripts (preinstall/postinstall) in any skill package before allowing it into production sandboxes.
Known benign look-alikes
- Legitimate scheduled skill synchronisation — the Miaoda sandbox running its own update-skills step to pull the current published version of the package. This rule cannot distinguish a clean release from a tampered one; every hit should be triaged against the resolved version/integrity in the lockfile.
- A developer or CI job running npm/pnpm/yarn install in the monorepo that declares @lark-apaas/coding-miaoda-sandbox-skills as a dependency, including lockfile regeneration and container image builds.
- Release engineering for the package itself (npm pack, npm link during local development, tarball extraction while testing a release candidate).
- Security or dependency-review tooling that installs the package into a throwaway directory to analyse it (the read-only filters cover view/ls/audit and --dry-run, but an analysis workflow that genuinely installs will match).