T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:930
- Finding
- Unpinned npx Commands May Retrieve and Execute Mutable Third-Party Packages<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:930-940` and `SKILL.md:980` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```yaml run: npx eslint {staged_files} run: npx prettier --check {staged_files} run: npx commitlint --edit {1} ``` ```yaml command: "npx conventional-changelog -p angular -i CHANGELOG.md -s" ``` ### Technical Analysis The Skill recommends invoking development tools through `npx` without requiring locally installed, lockfile-controlled versions. If a requested package is not available in the local dependency tree, `npx` may retrieve it from the configured package registry and execute it. This creates a mutable supply-chain execution path: the code executed at runtime is not necessarily the code that was present or reviewed when the configuration was generated. The commands also lack `--no-install`, exact package versions, registry restrictions, integrity verification, or an explicit prerequisite to install dependencies using a frozen lockfile. The affected commands are proposed for Git hooks and changelog generation. Git hooks run in a developer's repository context, while equivalent CI tasks may execute with access to source code, environment variables, package registry credentials, release tokens, or other CI secrets. No evidence shows that the named packages are currently malicious. The vulnerability is the unsafe dependency execution pattern and its exposure to registry compromise, dependency confusion, package substitution, or an unexpectedly compromised future release. ### Attack Path 1. A user copies the recommended hook or changelog configuration into a repository. 2. One of the referenced packages is absent from the local dependency tree, or the execution environment does not contain installed project dependencies. 3. The hook or release command invokes `npx`. 4. `npx` resolves and downloads a package from the configured registry. 5. A compromis ...[truncated 1129 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Declare each tool as an exact or tightly constrained development dependency in the repository: ```bash npm install --save-dev --save-exact eslint prettier @commitlint/cli conventional-changelog-cli ``` 2. Commit the generated lockfile and install dependencies in CI using a frozen, reproducible installation: ```bash npm ci ``` 3. Prevent `npx` from downloading missing packages: ```yaml run: npx --no-install eslint {staged_files} run: npx --no-install prettier --check {staged_files} run: npx --no-install commitlint --edit {1} ``` 4. Prefer explicit package scripts that resolve binaries from the project's installed dependency tree: ```json { "scripts": { "lint": "eslint .", "format:check": "prettier --check .", "changelog": "conventional-changelog -p angular -i CHANGELOG.md -s" } } ``` 5. Configure CI to use an approved registry, disable unexpected lifecycle scripts where practical, and verify lockfile integrity. 6. Add dependency review, registry allowlisting, provenance verification, and automated vulnerability monitoring for build and release dependencies. 7. Update the Skill guidance to state explicitly that these commands must only run after a lockfile-backed installation and must fail rather than retrieve packages dynamically. ]]>