T08 · Insecure Dependencies
- Location
SKILL.md:1006- Finding
Unpinned Package Retrieval and Execution Through npx
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 1006-1007
Vulnerability Type: Unpinned third-party package execution
Risk Level: MediumVulnerable Code
bash # shadcn/ui (open code, owned components) npx shadcn@latest init npx shadcn@latest add button card badge separator inputA related recommendation also appears at line 99:
markdown | Modern SaaS where you own the components | shadcn/ui (`npx shadcn@latest add ...`) | You own the code, easy to customise; never ship default state |Technical Analysis
The skill instructs the agent to invoke
npxwith the mutablelatestdistribution tag. If the package is not already present locally,npxcan retrieve it from the configured npm registry and immediately execute its command-line entry point.Because
latestdoes not identify an immutable, previously reviewed release, the effective code executed by this instruction can change after the skill itself has been audited. The instruction does not require an exact version, lockfile validation, package-integrity review, registry verification, or execution in a restricted environment.This creates a supply-chain trust boundary: security depends on the future state of the package, its maintainers, the npm account and registry configuration, and the dependencies resolved at execution time. The audit found no evidence that the referenced package is currently malicious; the vulnerability is the unsafe, unpinned execution pattern.
Attack Path
- An attacker compromises the package maintainer account, package release process, npm registry path, or one of the dependencies included in a future release.
- The attacker publishes malicious or compromised code under the version referenced by the mutable
latesttag. - An agent follows the skill and runs
npx shadcn@latest initor the subsequentaddcommand. npxdownloads and executes the newly resolved package code.- The malicious process runs with the operatin ...[truncated 1108 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace the mutable
latesttag with an exact, reviewed version:bash npx --yes shadcn@X.Y.Z init npx --yes shadcn@X.Y.Z add button card badge separator input -
Document the approved version in the skill and update it only after a security review.
-
Verify package provenance and registry configuration before execution:
bash npm config get registry npm view shadcn@X.Y.Z version dist.integrity dist.tarball -
Download and inspect the package before running its entry point when operating in a sensitive environment:
bash npm pack shadcn@X.Y.Z -
Preserve and review lockfile changes generated by the command. Use reproducible installation controls such as
npm cifor subsequent installs. -
Run scaffolding tools in a sandbox or disposable workspace with:
- No production credentials in the environment.
- Access limited to the target project directory.
- Restricted outbound network access.
- No administrative or root privileges.
-
Review all generated files and dependency changes before committing or executing the generated application.
-
Apply the same exact-version policy to every executable package command documented by the skill.
-