(magpie) branch sandbox/allow-npm-node-astral updated: docs(sandbox): note that registry.npmjs.org is an egress channel (#1566)

[po...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

potiuk pushed a commit to branch sandbox/allow-npm-node-astral
in repository https://gitbox.apache.org/repos/asf/magpie.git


The following commit(s) were added to refs/heads/sandbox/allow-npm-node-astral by this push:
     new c06695ef docs(sandbox): note that registry.npmjs.org is an egress channel (#1566)
c06695ef is described below

commit c06695efedf70235d964b60fa42a28932cd2118b
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Fri Oct 9 09:42:12 2026 +0200

    docs(sandbox): note that registry.npmjs.org is an egress channel (#1566)
    
    registry.npmjs.org accepts `npm publish` on the same host, so unlike the
    download-only release hosts it lets a compromised sandboxed command with
    its own npm token publish data out. Say so next to the entry, compare it
    with the GitHub hosts already allowed, and name how to close it.
    
    Generated-by: Claude Opus 5
---
 docs/setup/secure-agent-setup.md | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/docs/setup/secure-agent-setup.md b/docs/setup/secure-agent-setup.md
index ef2cda40..54a80aa5 100644
--- a/docs/setup/secure-agent-setup.md
+++ b/docs/setup/secure-agent-setup.md
@@ -592,8 +592,19 @@ below, annotated.
         // packages `language: node` hooks install (markdownlint-cli2's
         // deps, the Claude Code CLI behind `check-claude-mods`), and
         // `releases.astral.sh` the uv and managed-Python builds that
-        // prek and uv fetch. Build-time downloads only, all from the
-        // tools' official release hosts.
+        // prek and uv fetch. All three are the tools' official release
+        // hosts, used for build-time downloads.
+        //
+        // Egress trade-off: `nodejs.org` and `releases.astral.sh` only
+        // serve downloads, but `registry.npmjs.org` also accepts
+        // `npm publish` on the same host (unlike PyPI, whose uploads go to
+        // `upload.pypi.org`, which is not allowed). A compromised
+        // sandboxed command carrying its own npm token could publish data
+        // out through it. That is the same class of channel the GitHub
+        // hosts above already open (a gist, a push or an issue with an
+        // attacker's token), so it adds a channel, not a new kind of risk.
+        // To close it, drop `registry.npmjs.org` here and build the node
+        // hooks' environments outside the sandbox or in CI.
         "registry.npmjs.org", "nodejs.org", "releases.astral.sh"
       ],
       // Lets native-TLS CLI tools (lychee — and, per the schema, gh /