T08 · Insecure Dependencies
Warning
- Location
TROUBLESHOOTING.md:126- Finding
Unpinned Arbitrary npm Package Execution with Unsafe Global Installation Guidance
- Content
View full analysis
Vulnerability Details
File Location:
TROUBLESHOOTING.md, lines 126-132
Vulnerability Type: Supply-chain risk from unpinned package execution and unsafe installation permissions
Risk Level: MediumVulnerable Code
bash ### "npm install fails" ```bash # Use npx instead for one-off tools npx @somepackage/command # Or install globally with correct permissions npm install -g @somepackage --unsafe-perm=truetext ### Technical Analysis The troubleshooting guide recommends downloading and executing an unspecified npm package through `npx`. It also suggests globally installing that package with `--unsafe-perm=true`. The package name and version are not pinned, and no publisher, integrity hash, lockfile, signature, or trusted registry requirement is provided. Consequently, the code ultimately executed depends on mutable registry content at installation time rather than reviewed project content. npm packages may execute lifecycle scripts during installation. The `npx` command can retrieve and immediately run a package that is not locally installed. The global-install alternative broadens system impact, while `--unsafe-perm=true` allows package lifecycle scripts to retain the invoking process's privileges instead of applying npm's historical privilege-reduction behavior. This can expose users to dependency confusion, typosquatting, publisher compromise, malicious package updates, or accidental execution of an unrelated package. The placeholder does not itself identify a malicious package, but the documented workflow is unsafe if users substitute an untrusted or misspelled package. ### Attack Path 1. A user encounters an npm installation problem and follows the troubleshooting guide. 2. The user replaces `@somepackage/command` with an attacker-controlled, compromised, or misspelled package name. 3. The user runs `npx`, causing npm to retrieve and execute registry-controlled code, or performs the global installation with `--unsafe-perm=tru ...[truncated 1116 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the generic recommendation to execute arbitrary package placeholders with
npx. - Document only packages that are actually required and have been reviewed.
- Pin every recommended package to an exact version, for example
package-name@1.2.3. - Prefer project-local, lockfile-controlled dependencies over global installations.
- Verify the package publisher, registry source, provenance, signature where available, and integrity metadata before installation.
- Avoid recommending
--unsafe-perm=true; do not run package installation commands with administrative privileges. - Use
npx --no-installwhen execution must be restricted to an already installed and reviewed local dependency. - Configure an approved npm registry and dependency allowlist in managed environments.
- Audit package lifecycle scripts and use installation controls such as
--ignore-scriptswhen scripts are unnecessary. - Replace the affected section with package-specific recovery steps that preserve least privilege and reproducible dependency resolution.
- Remove the generic recommendation to execute arbitrary package placeholders with