T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:41
- Finding
- Unpinned Global npm Package Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 14–20 and 41–47 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium The skill configuration declares an npm installation without constraining the package version: ```yaml install: - id: npm kind: node package: thoth-cli bins: ["thoth"] label: "Install thoth-cli from npm" registry: "https://www.npmjs.com/package/thoth-cli" ``` The documented installation command also installs the mutable latest release globally: ```markdown ## Installation ```bash npm install -g thoth-cli ``` The package is published on npm by `aklo360`. Verify at: https://www.npmjs.com/package/thoth-cli ``` ### Technical Analysis Although the skill identifies itself as version `0.2.26`, neither the installation metadata nor the documented npm command pins `thoth-cli` to that version. Consequently, installation resolves to whichever package version is current under the npm package name at execution time. npm installation can execute package lifecycle scripts, such as `preinstall`, `install`, and `postinstall`. Therefore, a compromised publisher account, malicious future release, or compromised transitive dependency could introduce executable code that was not present during this audit. The use of global installation increases exposure by placing the package and its executable in the user's global npm environment. The supplied project contains no local executable code demonstrating that `thoth-cli` is malicious. The risk arises from the mutable, unpinned supply-chain trust boundary. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or an included dependency. 2. The attacker publishes a malicious release under the legitimate `thoth-cli` package name. 3. A user or agent follows the skill instruction and runs `npm install -g thoth-c ...[truncated 1009 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the package to the exact reviewed version in both installation mechanisms: ```yaml package: thoth-cli@0.2.26 ``` ```bash npm install -g thoth-cli@0.2.26 ``` 2. Verify package integrity and provenance before installation. Record and validate the expected npm integrity digest, package publisher, and registry source. 3. Review and lock transitive dependencies for the selected release. Re-audit the package before changing the pinned version. 4. Prefer installation in an isolated, least-privilege environment rather than the global npm environment, such as a dedicated container or restricted project-local installation. 5. Disable npm lifecycle scripts where they are unnecessary and compatibility has been verified: ```bash npm install --ignore-scripts thoth-cli@0.2.26 ``` 6. Do not run the installation as an administrator or root user. Restrict filesystem, credential, environment-variable, and network access available to the package at installation and runtime.