T08 · Insecure Dependencies
Error
- Location
- SKILL.md:43
- Finding
- Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 43–46 and line 64 **Vulnerability Type**: Unpinned and mutable third-party dependency execution **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions also permit use of the alternate registry: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill directs the Agent to install and execute `@iqinghu/qhkit` without pinning an audited version or verifying package integrity. The `@latest` upgrade instruction explicitly resolves to a mutable release. The `npx` fallback can download and immediately execute the package without a persistent, reviewable installation. npm installation may execute package lifecycle scripts in addition to installing the CLI. Consequently, compromise of the package publisher, npm account, registry infrastructure, or a future package release could result in arbitrary code execution. Using a mirror introduces an additional supply-chain trust boundary. Global installation is broader than necessary for invoking a single Skill. Although the instructions recommend avoiding privilege elevation when global installation fails, any global installation performed from a privileged npm environment would run installation logic with those elevated privileges. ### Attack Path 1. An attacker compromises the package publisher account, upstream package, release process, or configured registry. 2. The attacker publishes a malicious release under the legitimate `@iqinghu/qhkit` package name. 3. The Agent follows the Skill instructions and resolves the unpinned package or `@latest` release. 4. npm lifecycle scripts or the downloaded CLI execute malicious code during installation or invocation. 5. The malicious code accesses resources available to the invoking account, potenti ...[truncated 1218 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific, reviewed version rather than using an unqualified package name or `@latest`. 2. Record and verify the expected npm integrity value for the approved package artifact. 3. Replace automatic upgrades with a controlled process that reviews release provenance, changelogs, package contents, and integrity before deployment. 4. Prefer a project-local installation with a committed lockfile over global installation. 5. Avoid `npx` auto-download behavior. If it must be used, specify an exact version and prevent fallback to another package version. 6. Use the primary npm registry unless the alternate mirror has been explicitly approved. Apply equivalent integrity validation regardless of registry. 7. Consider installation with lifecycle scripts disabled where compatible: ```bash npm install --ignore-scripts --save-exact @iqinghu/qhkit@<reviewed-version> ``` If lifecycle scripts are required, review them before installation. 8. Run the CLI in a restricted environment with access only to the media files needed for the requested operation. Do not expose unrelated files, credentials, or environment variables. 9. Require explicit user approval before installing or upgrading the dependency, and clearly identify the version, registry, and expected privileges. 10. Never run the installation with administrative privileges unless independently justified and approved.