privesc-linux

This skill is internally consistent with its stated purpose, but that purpose is inherently high risk: it equips an AI agent to perform offensive privilege escalation, container escape, and persistence on real Linux systems. Install trust is relatively clean because no external installer, proxy, or credential-forwarding path is shown, but the operational impact is severe and disproportionate for normal developer workflows. Classified as suspicious/high-risk offensive capability rather than confirmed malware.

The fragment is non-executable security documentation containing both detection guidance and actionable privilege-escalation and evasion instructions. It does not itself demonstrate embedded malware or an npm supply-chain payload, but its operational focus on exploiting sudo, obtaining root execution, avoiding telemetry, and deleting evidence creates a high security concern if included in a package without a clear defensive purpose. Assessment of the larger file remains limited because surrounding code is not shown.

The fragment is exploit and privilege-escalation reference material with actionable local-root exploitation examples and some evasion guidance. It is potentially dangerous if distributed to or executed by unprivileged users, but the shown content is documentation and detection configuration rather than malware or an npm supply-chain backdoor. The unverified future CVE claims should be independently validated.

This is an instructional container-escape document containing highly actionable exploit and post-exploitation commands. It does not itself execute code or demonstrate embedded package malware, but several examples can compromise a host when manually run in a vulnerable or misconfigured environment. Treat as sensitive offensive security material and restrict execution to authorized test environments.

The fragment is a readable container-escape assessment script that mainly performs local, read-only enumeration. It does not itself execute an escape or exfiltrate data, but it prints highly actionable attack commands and, with --runc-poc, emits a Dockerfile intended to exploit CVE-2024-21626 and read host secrets. This is better classified as dual-use offensive security tooling with elevated misuse risk than as confirmed package malware.

The code contains a deliberate, functional local privilege-escalation exploit path. Its default mode is primarily a vulnerability detector, but --exploit writes, compiles, and executes an NSS payload designed to obtain a root bash shell through sudo chroot handling. It should only be run in a controlled, explicitly authorized test environment; it is unsafe as a general diagnostic script. No evidence of network-based malware or data exfiltration appears in this fragment.

This is an explicit Linux privilege-escalation and detection reference containing runnable exploit and post-exploitation commands. It is dangerous to execute on production systems, particularly the curl/chmod/execute sequence and commands that create SUID files or alter privileged configuration. No hidden package malware, persistence, data exfiltration, or obfuscation is evident in the supplied text; the primary risk is direct misuse of the documented commands.

The supplied text is an offensive Linux privilege-escalation and credential-enumeration playbook with explicit EDR-evasion and artifact-cleanup guidance. It is not itself executable malware and contains no direct exfiltration or persistence payload, but it materially facilitates unauthorized discovery, credential access, exploitation, and stealth. Treat it as high-risk offensive content; assessment of the referenced tools or scripts would require their actual source or binaries.