T08 · Insecure Dependencies
Error
- Location
- SKILL.md:102
- Finding
- Automatic Installation and Execution of an Unpinned npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:102-106` **Vulnerability Type**: Unpinned third-party dependency and unsafe automatic upgrade **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit@latest ``` Related installation instructions at `SKILL.md:75-79` also recommend installing or immediately executing the package without pinning an audited version: ```bash npm i -g @iqinghu/qhkit ``` ### Technical Analysis The Skill instructs the Agent to globally install the mutable `@iqinghu/qhkit` npm package and explicitly recommends upgrading to the `latest` release. No exact version, package-lock file, independently verified integrity digest, or locally reviewable package source is provided. An npm installation may execute package lifecycle scripts, while subsequent CLI invocations execute the installed package with the permissions of the Agent's operating-system account. Using `@latest` means the effective code can change after this Skill has been reviewed. The fallback recommendation to use `npx` has the same fundamental risk because it can retrieve and immediately execute a mutable package release. The external CLI handles workflow parameters, local file uploads, profile URLs that may include access-related query parameters, and the `QHKIT_TOKEN` or stored API credentials. Because the CLI source is not included in the audited project, its credential access, file access, network destinations, telemetry, and data-retention behavior cannot be independently verified. The documented Node.js download is not a `curl | bash` execution. It downloads an archive and verifies it using `sha256sum` before extraction. The confirmed issue is instead the mutable npm dependency installation. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry response, or configured package mirror for `@iqinghu/qhkit`. 2. The attacker publishes a malicious release and assigns it the `latest` distr ...[truncated 1443 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` and all unversioned installation commands with an exact, reviewed package version, for example: ```bash npm install --save-exact @iqinghu/qhkit@<AUDITED_VERSION> ``` 2. Commit a lockfile containing the resolved package graph and npm integrity values. Install with `npm ci` rather than allowing dependency resolution to change during execution. 3. Avoid global installation. Install the package in a dedicated, minimally privileged project directory or isolated container so it cannot replace tools used by unrelated sessions. 4. Do not automatically upgrade in response to stderr notices. Require explicit user approval and a security review before changing the installed version. 5. Avoid automatic `npx` execution of packages not already present locally. If `npx` is unavoidable, specify an exact version and prevent interactive substitution or unexpected package resolution. 6. Publish or vendor the relevant CLI source so its file access, credential handling, upload behavior, network endpoints, lifecycle scripts, and telemetry can be audited. 7. Verify the package against an independently published integrity digest or signed provenance record. Do not rely solely on a checksum delivered by the same registry or mirror as the package. 8. Run the CLI with a restricted environment containing only the required token and input files. Use a narrowly scoped API token, limit filesystem access, and prevent access to unrelated credentials. 9. Require informed user confirmation before installing software, sending profile URLs or query parameters to the external service, or uploading local files. ]]>