npm-vulnerability-analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required runtime workflow (via scripts/index.js → scanning versions and generating reports) ingests outsider-authored free text from npm advisory/audit data—e.g., vulnerability title/url/range fields returned by npm audit --json and then rendered into the report—so untrusted prose from third parties can enter the agent’s LLM context indirectly through the generated report content.