T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:42
- Finding
- Unpinned Third-Party CLI Installation and Automatic Upgrade<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 42–66 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` Fallback installation through a mirror or `npx` is also recommended: ```bash npm i -g @iqinghu/qhkit --registry=https://registry.npmmirror.com npx @iqinghu/qhkit <command> ... ``` The upgrade procedure installs the latest available release without pinning it: ```bash npm i -g @iqinghu/qhkit@latest ``` The mirror may again be selected during upgrades: ```bash npm i -g @iqinghu/qhkit@latest --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill directs the Agent to install and execute an externally maintained npm package that is not included in the audited project. Neither the normal installation nor the `npx` fallback pins an exact package version or validates package integrity. The upgrade procedure explicitly selects `@latest`, allowing the code executed by future Skill invocations to change after this review. npm installation can execute package lifecycle scripts, while subsequent `qhkit` or `npx` invocation executes the installed package directly. Consequently, compromise of the package, its maintainer account, the registry distribution path, or the optional mirror could result in arbitrary code execution under the account performing the installation. Global installation increases the dependency's system-wide exposure within the user's npm environment. Although the instructions do not request `sudo` and recommend `npx` after permission failures, a user who independently runs the global installation with elevated privileges could increase the resulting impact. The optional `registry.npmmirror.com` fallback introduces an additional supply-chain trust boundary. No evidence establishes that the mirror or package is malicious; the risk is caused by mutable, unpinned executable dependencies and the absence of independent ...[truncated 2145 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a reviewed, exact version rather than using an unconstrained package name or `@latest`. 2. Record and verify the expected package integrity hash before installation. 3. Remove automatic upgrade instructions. Require a separate review and integrity update before adopting a new release. 4. Prefer a project-local installation governed by a lockfile over global installation: ```bash npm install --save-exact @iqinghu/qhkit@<reviewed-version> ``` 5. Invoke the locked local binary instead of allowing `npx` to resolve an arbitrary current release: ```bash ./node_modules/.bin/qhkit ... ``` 6. Where compatible with the package, disable lifecycle scripts during installation: ```bash npm install --ignore-scripts --save-exact @iqinghu/qhkit@<reviewed-version> ``` If lifecycle scripts are required, review them before permitting execution. 7. Use the primary npm registry by default. If a mirror is operationally necessary, independently validate its provenance and verify package integrity against a trusted source. 8. Run the CLI as an unprivileged, isolated account or inside a restricted container with access only to the specific input and output files needed for the image-processing task. 9. Provide the token through a narrowly scoped secret mechanism, prevent it from appearing in shell history or logs, and rotate it after any suspected dependency compromise. 10. Inform users that local images are uploaded to an external service and obtain consent before processing confidential or sensitive material. ]]>