T08 · Insecure Dependencies
- Location
SKILL.md:203- Finding
Unpinned Third-Party Actions, Packages, CLIs, and Container Images
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:203-217,SKILL.md:246-249,SKILL.md:273,SKILL.md:344-346, andSKILL.md:357-358
Vulnerability Type: Supply-chain risk through unpinned third-party dependencies
Risk Level: MediumVulnerable Code
yaml - uses: actions/checkout@v4 - name: Setup Node.js uses: actions/setup-node@v4yaml - name: Upload coverage uses: codecov/codecov-action@v3 with: files: ./coverage/lcov.infobash # Install npm install --save-dev @stryker-mutator/core @stryker-mutator/jest-runner # Run npx stryker runbash # Install pip install mutmutbash # Docker scan docker run -t owasp/zap2docker-stable zap-baseline.py \ -t https://example.com \ -r report.htmlbash # Snyk npx snyk test npx snyk monitorTechnical Analysis
The examples retrieve and execute third-party GitHub Actions, npm packages, Python packages, command-line tools, and a Docker image without pinning them to immutable, reviewed artifacts.
GitHub Action references such as
@v4and@v3are mutable tags rather than full commit hashes. The npm and pip installation commands do not specify exact package versions. Theowasp/zap2docker-stableimage uses a mutable image tag rather than a content digest. In addition,npx snykcan download and execute the currently resolved package if Snyk is not already installed locally.Consequently, identical commands may execute different code at different times. If an upstream release, registry account, Action tag, transitive dependency, or container image is compromised, the documented workflow can introduce attacker-controlled code into a developer workstation or CI runner.
Attack Path
- An attacker compromises a referenced package publisher, container registry account, GitHub Action repository, mutable tag, or relevant transitive dependency.
- The attacker ...[truncated 1414 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin GitHub Actions to reviewed full commit SHAs instead of mutable major-version tags:
yaml - uses: actions/checkout@REVIEWED_FULL_COMMIT_SHA - uses: actions/setup-node@REVIEWED_FULL_COMMIT_SHA - uses: codecov/codecov-action@REVIEWED_FULL_COMMIT_SHAKeep a comment identifying the corresponding release version and use an automated dependency updater to propose reviewed changes.
-
Pin npm development dependencies to audited exact versions and commit the generated lockfile:
bash npm install --save-dev --save-exact \ @stryker-mutator/core@AUDITED_VERSION \ @stryker-mutator/jest-runner@AUDITED_VERSION npm ci npx --no-install stryker runUse
npm ciin CI so installation follows the committed lockfile without silently changing dependency resolution. -
Pin Python dependencies to reviewed versions and use hashes where practical:
text mutmut==AUDITED_VERSION --hash=sha256:VERIFIED_PACKAGE_HASHInstall from a reviewed requirements file with hash enforcement:
bash pip install --require-hashes -r requirements-testing.txt -
Install Snyk as a pinned, locked development dependency and prevent
npxfrom downloading an undeclared package:bash npm install --save-dev --save-exact snyk@AUDITED_VERSION npx --no-install snyk test npx --no-install snyk monitor -
Pin the OWASP ZAP container image by an audited digest:
bash docker run -t owasp/zap2docker-stable@sha256:VERIFIED_IMAGE_DIGEST \ zap-baseline.py -t https://example.com -r report.html -
Run third-party testing tools with least privilege. Restrict CI token permissions, avoid exposing unrelated secrets, use isolated runners where possible, and grant write permissions only to steps that require them.
-
Establish a controlled update process that verifies package provenance ...[truncated 147 chars]
-