T08 · Insecure Dependencies
Error
- Location
- references/validate-angular.sh:27
- Finding
- Unpinned npx Commands Can Retrieve and Execute Unreviewed Packages<![CDATA[ ## Vulnerability Details **File Location**: `references/validate-angular.sh:27-41`; `references/validate-js.sh:10-17` **Vulnerability Type**: Supply-chain exposure through unpinned package execution **Risk Level**: High ### Vulnerable Code ```bash # references/validate-angular.sh npx eslint src/ || { echo "❌ Error: eslint failed" exit 1 } npx prettier --write src/ || { echo "⚠️ Warning: Prettier failed, continuing..." } npx eslint --fix src/ || { echo "⚠️ Warning: ESLint --fix failed, continuing..." } ``` ```bash # references/validate-js.sh npx eslint src/ npx prettier --check src/ if grep -q "vitest" package.json; then npx vitest run --coverage elif grep -q "jest" package.json; then npm test -- --coverage else npm test fi ``` ### Technical Analysis The validation scripts invoke `eslint`, `prettier`, and `vitest` through `npx` without exact version constraints or an explicit requirement to resolve only packages already installed from the project's lockfile. If a requested executable is unavailable locally, `npx` can resolve and retrieve a package from the configured npm registry. This creates a remote code execution channel whose effective payload may change after the Skill has been reviewed. A compromised registry account, malicious registry configuration, dependency confusion condition, or later-compromised package release could cause attacker-controlled lifecycle or executable code to run. The implementation also conflicts with `SKILL.md:458-460`, which states that `npx` is allowed only with pinned versions. ### Attack Path 1. The Skill runs an Angular or JavaScript validation script in a target repository. 2. One or more requested executables are not present in the local `node_modules/.bin` directory, or npm is configured to use an attacker-influenced registry. 3. `npx` resolves the unpinned package name through the configured registry. 4. A compromised or substituted package is downloaded. 5. Package installatio ...[truncated 735 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require dependencies to be declared in the target project's manifest and resolved through a reviewed, integrity-protected lockfile. 2. Execute only local binaries, for example: ```bash test -x node_modules/.bin/eslint || { echo "eslint is not installed locally" >&2 exit 1 } ./node_modules/.bin/eslint src/ ``` 3. Alternatively, use an offline or local-only npm execution mode that fails rather than downloading an absent package. 4. If remote installation is explicitly necessary, pin every package to an exact reviewed version and use lockfile integrity validation. 5. Run `npm ci` rather than unconstrained installation where appropriate, and configure an approved registry. 6. Apply the same policy consistently to `eslint`, `prettier`, and `vitest` in both validation scripts. ]]>