T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:42
- Finding
- Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 42–46 and 68–72 **Vulnerability Type**: Unpinned and mutable npm dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` The instructions also permit on-demand execution through `npx`: ```bash npx @iqinghu/qhkit <command> ... ``` The documented upgrade procedure explicitly installs the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` Both installation procedures may use an alternate registry: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill instructs the Agent to download and execute an npm package without pinning an exact version or verifying package integrity. It also directs the Agent to install `@latest` in response to version-related messages emitted by the same external CLI. npm installation can execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Consequently, installing a mutable package is itself a local code-execution operation. The package implementation is not included in the audited project, so its behavior and future releases cannot be reviewed from this repository. Global installation unnecessarily broadens the modification scope compared with a project-local, isolated installation. Depending on the npm prefix and the privileges of the Agent process, installation can modify user-level or system-level executable and module directories. Using `npx` does not eliminate the risk because it can download and execute an unresolved package version on demand. The alternate registry is presented as a network fallback rather than an overtly malicious source, but it introduces an additional supply-chain trust boundary. The reviewed file provides no package digest, lockfile, signature, or provenance verification for either registry. The Node.js bootstrap at lines 52–55 is not a `curl | bash` operation. It downloads an archive and verifies it agai ...[truncated 2027 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version instead of using an implicit current release or `@latest`: ```bash npm install --save-exact @iqinghu/qhkit@<reviewed-version> ``` 2. Maintain a lockfile with integrity hashes and install with a reproducible command such as `npm ci`. 3. Prefer a project-local installation over `npm i -g`. Invoke the pinned local binary from `node_modules/.bin` or through a checked project script. 4. Do not allow version-gate messages emitted by the external CLI to trigger automatic upgrades. Present the requested version and obtain explicit user or administrator approval before changing executable dependencies. 5. Avoid unpinned `npx` execution. If `npx` is unavoidable, specify the exact reviewed package version and prevent automatic package acquisition where supported. 6. Verify package provenance and integrity. Consider npm provenance attestations, trusted publisher information, an approved internal registry, or a vendored and independently hashed artifact. 7. Review the dependency package and its transitive dependencies before approval, including lifecycle scripts and network behavior. 8. Run the CLI in a restricted environment with only the media files required for the task. Do not expose unrelated home-directory content or unnecessary environment variables. 9. Store `QHKIT_TOKEN` in a scoped secret store, provide it only to the required process, and ensure it is not inherited by installation scripts. 10. If a mirror is required, document its trust model and require the same pinned version and integrity metadata used for the primary registry. ]]>