T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:96
- Finding
- Unpinned npm Package Installation and Immediate Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 96–99 and 119–123 **Vulnerability Type**: Unpinned third-party dependency installation and execution **Risk Level**: Medium ### Complete Code Snippet ```bash npm i -g @iqinghu/qhkit ``` ```text Only when global installation fails because of permissions and privilege elevation is unavailable, fall back to `npx @iqinghu/qhkit <command> ...`. ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the agent to install `@iqinghu/qhkit` without an exact version and explicitly recommends upgrading to `@latest`. The `npx` fallback can also download and immediately execute the registry-selected package release. These commands make the effective executable dependency mutable after the Skill has been reviewed. If the package, maintainer account, npm registry path, or configured mirror is compromised, a malicious release could execute through npm lifecycle scripts or when the CLI is invoked. Installing the CLI is necessary for the declared video-generation functionality, but automatic unpinned installation and upgrades are not the minimum-risk approach. A reviewed exact version would provide the required functionality while reducing supply-chain exposure. The separately flagged checksum command is not a remote shell execution pipeline. It downloads a checksum manifest and passes a selected checksum to `sha256sum -c`; it does not pipe downloaded content into Bash. ### Attack Path 1. An attacker compromises the `@iqinghu/qhkit` package, a maintainer account, a registry distribution path, or an allowed mirror. 2. The attacker publishes or serves a malicious package version. 3. An agent follows the Skill instructions and runs an unversioned installation, `@latest` upgrade, or `npx` invocation. 4. npm retrieves the attacker-controlled release. 5. Malicious lifecycle code or CLI code executes with the permissions of the user running the agent. 6. The code can acce ...[truncated 1014 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a reviewed exact version instead of installing an unspecified release or `@latest`: ```bash npm install -g @iqinghu/qhkit@<reviewed-exact-version> ``` 2. Record and verify the package's npm integrity value or use a lockfile where the installation model permits it. 3. Remove automatic upgrades to `@latest`. Require a separate review and integrity update before changing the approved version. 4. Pin the package version in all `npx` instructions: ```bash npx --package=@iqinghu/qhkit@<reviewed-exact-version> qhkit <command> ``` 5. Where compatible with the package, suppress lifecycle scripts during installation: ```bash npm install --ignore-scripts ... ``` Validate functionality first because some legitimate packages require installation scripts. 6. Prefer a user-scoped installation and avoid privilege elevation. Do not run npm installation commands as root unless a documented operational requirement exists. 7. Treat registry mirrors as separate trust dependencies. Use an explicitly approved registry over HTTPS and verify package integrity independently of the mirror. 8. Before execution, validate the installed version against an allowlist and fail closed if it differs from the reviewed version. ]]>