npm run analyze was approved 64.7% of the time in a browser game about reviewing AI coding-agent commands. It was the most-missed dangerous prompt in the dataset.
The author analyzed more than 40,000 game runs and 409,000 approve/deny decisions. Obvious destructive commands such as rm -rf / had an 11.7% miss rate. Exfiltration and code-execution commands reached 33.4%. Three malicious npm run ... prompts were missed 52.5% of the time, compared with 28.4% for the other exfiltration-style attacks.
The script name supplied the feeling of safety. The actual command lived in package.json and could have been changed by an earlier file edit.
The study has an important limit. It came from a short, time-pressured game where roughly 34% of commands were threats. Those percentages do not describe the base rate of a production environment. They do show how a familiar label changes review behavior inside the same game.
For a routine-looking npm script, the review target is the script definition and the files changed before the prompt appeared.
Source: ScaleX analysis.
Top comments (0)