T08 · Insecure Dependencies
Warning
- Location
scripts/init-vite.sh:19- Finding
Vite initializer downloads and executes mutable npm packages
- Content
View full analysis
.nvmrc echo "📦 Installing dependencies..." # Install Tailwind CSS npm install -D tailwindcss postcss autoprefixer npx tailwindcss init -p # Install animation library npm install framer-motion # Install shadcn/ui base dependencies npm install tailwindcss-animate class-variance-authority clsx tailwind-merge npm install lucide-react npm install @radix-ui/react-slot ``` The initializer later executes another mutable package: ```bash # Install common components via shadcn CLI npx shadcn@latest add button badge card accordion dialog navigation-menu tabs sheet separator avatar alert -y || { echo "⚠️ Warning: Some shadcn components may not have installed. Run 'npx shadcn@latest add [name]' manually." } ``` ### Technical Analysis The initializer downloads packages without exact versions and directly executes packages selected through the mutable `latest` tag. It also does not rely on a committed lockfile or verified integrity values. `npm create` and `npx` execute package-provided code. In addition, `npm install` can run lifecycle scripts from direct or transitive dependencies. Consequently, the effective executable code can change after this repository has been reviewed. This is not evidence that the currently referenced packages are malicious. The vulnerability is the absence of controls that bind execution to reviewed package versions. ### Attack Path 1. An upstream package, package maintainer account, or transitive dependency is compromised. 2. A malicious release is published under a version matched by `latest` or an unbounded dependency range. 3. A user invokes `bash scripts/ ...[truncated 899 chars]- Remediation
View remediation