T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:43
- Finding
- Execution of Unpinned Third-Party npm Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43–46; related upgrade instruction at line 66 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` The related upgrade instruction explicitly installs the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` The document also recommends executing the package through `npx` as a fallback: ```bash npx @iqinghu/qhkit <command> ... ``` ### Technical Analysis The Skill depends on the executable npm package `@iqinghu/qhkit`, but the installation instructions do not pin it to a reviewed version or verify the package artifact against a trusted integrity value. The `@latest` upgrade instruction is explicitly mutable, while an unversioned `npx` invocation can download and execute whichever release the registry currently resolves. The package implementation is not included in the audited project, which contains only `SKILL.md`. Consequently, this audit cannot verify the dependency's lifecycle scripts, command implementation, credential handling, file-upload behavior, or network destinations. npm packages may run installation lifecycle hooks and subsequently execute arbitrary JavaScript when their command-line binaries are invoked. If the publisher account, package, npm registry path, or configured mirror is compromised, the downloaded implementation could change after this Skill has been reviewed. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry delivery path, or fallback mirror. 2. The attacker publishes a malicious release under `@iqinghu/qhkit` or causes the mutable package reference to resolve to malicious content. 3. A user or agent follows the Skill instructions and runs the unpinned global installation, the `@latest` upgrade, or the unversioned `npx` command. 4. npm downloads the changed package and may execute its lifecycle scripts during ...[truncated 1068 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact version that has been reviewed instead of using an unversioned package or `@latest`. 2. Record and verify the expected package integrity hash or distribute a reviewed lockfile and package artifact. 3. Remove automatic upgrade instructions. Require each new release to undergo review before updating the pinned version. 4. Avoid unversioned `npx` execution. If `npx` remains necessary, specify the exact reviewed version and prevent automatic substitution with a newer release. 5. Use a trusted registry explicitly and document that registry overrides must not redirect scoped packages to untrusted sources. 6. Consider installing with lifecycle scripts disabled where compatible, then invoke only the reviewed binary: ```bash npm install --ignore-scripts --global @iqinghu/qhkit@<reviewed-exact-version> ``` 7. Run the CLI in a restricted environment with access only to the required image files and token. Do not expose unrelated home-directory files, SSH credentials, or broad environment variables. 8. Store the API token with restrictive filesystem permissions and support narrowly scoped, revocable credentials. 9. Publish the dependency source or include a reviewable implementation in the project so its upload destinations, token handling, and command execution can be audited. 10. Continue checksum verification for the Node archive. The flagged checksum pipeline retrieves a manifest and passes it to `sha256sum -c`; it does not pipe remote content into a shell and is not itself a confirmed remote-script execution vulnerability. ]]>