T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:52
- Finding
- Unpinned Third-Party Packages Are Installed and Executed at Runtime<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:52-55`, `SKILL.md:78`, and `SKILL.md:91` **Vulnerability Type**: Supply-chain exposure through mutable, unpinned dependencies **Risk Level**: Medium ### Complete Code Snippets ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple ``` ```bash npx --yes sharp-cli -i ORIGINAL_IMAGE -o COMPRESSED_IMAGE.jpg resize 2048 ``` The instructions also permit npm registry fallback to: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill directs the Agent to install or immediately execute third-party packages without pinning exact versions or verifying package integrity. The `@latest` selector deliberately resolves to mutable code that may differ from what was present when the Skill was audited. The unversioned `@iqinghu/qhkit`, `pillow`, and `sharp-cli` dependencies have the same general issue. In particular, `npx --yes sharp-cli` downloads and executes package code without an interactive review step. Using multiple registries and mirrors also expands the supply-chain trust boundary. A compromised publisher account, malicious release, registry compromise, dependency takeover, or compromised transitive dependency could introduce arbitrary executable code. This is necessary only to the extent that the declared functionality requires the `qhkit` client and optional media-processing tools. Installing mutable packages globally or executing them through unattended `npx`, however, exceeds the safest minimum-privilege implementation. ### Attack Path 1. An attacker compromises a package publisher, release process, registry, mirror, or transitive dependency. 2. The attacker publishes malicious code under a version selected by an unpinned install command or by the `latest` tag. 3. The Agent follows the Skill instructions and runs `npm`, `pip`, or `npx`. 4. Package installation hoo ...[truncated 974 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a reviewed exact version rather than using unversioned packages or `@latest`. 2. Record and verify package integrity hashes through a lockfile or equivalent trusted manifest. 3. Remove `npx --yes`; install a reviewed, pinned version in advance and invoke its fixed local binary. 4. Avoid global package installation. Use a dedicated, unprivileged project directory, container, or virtual environment. 5. Require explicit user approval before installing or upgrading executable dependencies. 6. Restrict package installation scripts where feasible, such as by auditing lifecycle scripts before allowing them to run. 7. Use one approved registry and document its trust model. Do not silently switch to alternate mirrors. 8. Run media-processing tools with access limited to only the required input and output files. 9. Maintain and periodically review a software bill of materials for direct and transitive dependencies. ]]>