T08 · Insecure Dependencies
Error
- Location
- SKILL.md:42
- Finding
- Unpinned Third-Party Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 42–45 and line 63 **Vulnerability Type**: Unpinned npm dependency installation and execution **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```text Only when global installation fails because of permissions and privilege elevation is unavailable, fall back to `npx @iqinghu/qhkit <command> ...`. ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the Agent to install `@iqinghu/qhkit` globally without pinning an audited version. It also permits direct execution through `npx` and explicitly directs upgrades to `@latest`. npm installation can execute package lifecycle scripts, while invoking the resulting CLI executes code supplied by the package publisher. Because the selected package version can change after this Skill has been reviewed, the effective executable payload is not fixed by the audited project. A compromised publisher account, malicious future release, or upstream supply-chain compromise could therefore introduce arbitrary code without requiring any modification to `SKILL.md`. Global installation unnecessarily broadens the package's footprint compared with an isolated, version-pinned installation. Although the instructions do not request root access and recommend `npx` when global installation encounters permission errors, installed package code still runs with all permissions of the Agent's operating-system account. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or an upstream dependency used by a future `@iqinghu/qhkit` release. 2. The attacker publishes a malicious release under the legitimate package name. 3. The Agent follows the Skill instructions and runs an unversioned installation, an `@latest` upgrade, or `npx`. 4. npm retrieves the attacker-controlled release from the configured registry or fallback mirror. 5. Malicio ...[truncated 1010 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version instead of using an unversioned package or `@latest`. 2. Record and verify the expected npm integrity hash or package tarball digest before installation. 3. Remove automatic upgrade instructions. Require review and integrity verification before adopting each new release. 4. Avoid global installation where possible. Install the dependency in a dedicated, non-privileged project directory or isolated container. 5. Replace unrestricted `npx` execution with a version-pinned invocation and prevent implicit selection of a newer release. 6. Disable npm lifecycle scripts with `--ignore-scripts` if the audited package functions without them. If scripts are required, review them before installation. 7. Run the CLI with filesystem, environment-variable, and network access restricted to the minimum required for image processing. 8. Keep API tokens out of command history and ensure the token has narrowly scoped permissions, limited lifetime, and straightforward revocation. 9. Treat the fallback registry mirror as an additional supply-chain trust boundary and apply the same version and integrity validation regardless of registry.