T08 · Insecure Dependencies
Warning
- Location
- references/setup.md:14
- Finding
- Mutable Beta Dependency Is Installed Globally with Lifecycle Scripts Enabled## Vulnerability Details **File Location**: `references/setup.md:11-15` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash The npm beta is suitable for its published tool contract: npm install --global @pascal-app/cli@beta pascal editor --no-open ``` ### Technical Analysis The setup workflow installs `@pascal-app/cli` through the mutable npm distribution tag `beta`. Distribution tags can be moved to a different package version after this Skill has been reviewed, so the code ultimately installed is not fixed by the audited repository. The installation command also leaves npm lifecycle scripts enabled. If the package, publisher account, or release process is compromised, lifecycle scripts can execute during installation. The resulting globally available `pascal` executable is then explicitly invoked. Although the documentation later states which version the tag currently resolves to, that statement does not constrain npm resolution at installation time and does not verify package integrity. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or another mechanism capable of modifying the `beta` distribution tag. 2. The attacker publishes a malicious release or redirects `beta` to a compromised version. 3. A user follows the documented command, causing npm to resolve the mutable tag at that time. 4. Malicious lifecycle scripts can execute during installation with the invoking user's privileges. 5. The user subsequently runs `pascal editor --no-open`, allowing a replaced CLI to execute again and access resources available to that user. ### Impact Assessment Successful exploitation can provide code execution with the privileges of the user running npm. Depending on that user's environment, the malicious package could access local Pascal project data, user-readable files, environment variables, MCP configur ...[truncated 301 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the mutable tag with an exact, reviewed package version: ```bash npm install --global --ignore-scripts @pascal-app/cli@1.0.0-beta.1 ``` 2. Use `--ignore-scripts` if the reviewed CLI does not require installation lifecycle scripts. 3. Publish and verify a cryptographic integrity value or signed provenance for the exact package artifact. 4. Avoid privileged installation. Prefer a user-owned installation prefix or a project-scoped, locked dependency. 5. Document upgrades as a separate review process rather than silently following changes to a distribution tag. 6. Verify the installed version before execution and fail closed if it differs from the reviewed version.