T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:84
- Finding
- Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, line 84 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash npm install -g playwriter@latest ``` ### Technical Analysis The installation instruction uses the mutable `latest` npm distribution tag rather than a reviewed, exact package version. Consequently, the installed code can change without any corresponding modification to this skill. npm packages may define lifecycle scripts that execute during installation. Because the command performs a global installation, such scripts run with the privileges of the user invoking npm and can modify files or install additional components accessible to that account. If the package, its publishing account, or one of its transitive dependencies is compromised, following this instruction could execute attacker-controlled code. The audited file does not contain evidence that the current `playwriter` package is malicious. The vulnerability is the unsafe and non-reproducible dependency installation practice. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or a transitive dependency. 2. The attacker publishes a malicious release and assigns it to the `latest` distribution tag. 3. A user follows the skill documentation and runs `npm install -g playwriter@latest`. 4. npm downloads the attacker-controlled release and may execute its installation lifecycle scripts. 5. The malicious package executes with the installing user's privileges and can access resources available to that user. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the privileges of the user performing the installation. The attacker could read or alter user-accessible files, steal environment credentials, install additional malicious packages, or tamper with globally installed command-line tools. The affected scope is generally ...[truncated 220 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with a reviewed, exact version, for example: ```bash npm install --save-exact playwriter@<reviewed-version> ``` 2. Prefer a project-local dependency over a global installation and commit a lockfile to make dependency resolution reproducible. 3. Verify the package name, publisher, provenance, signatures, and integrity metadata against the official Playwriter distribution channel. 4. Audit the package and its transitive dependencies before approving version upgrades. 5. Where compatible with the package, disable lifecycle scripts during installation: ```bash npm install --ignore-scripts --save-exact playwriter@<reviewed-version> ``` 6. Perform installation without administrative privileges and in an isolated environment to limit the consequences of a supply-chain compromise. 7. Use automated dependency monitoring and require explicit review before updating the pinned version.