T08 · Insecure Dependencies
Warning
- Location
references/getting-started.md:6- Finding
Unpinned Third-Party Package and CDN Resources Without Integrity Protection
- Content
View full analysis
``` ### Technical Analysis The installation command does not specify an exact package version, so package resolution may select a future release that was not reviewed with this Skill. The CDN URLs similarly omit a version and therefore resolve mutable package content. The JavaScript resource is loaded directly from an external CDN and is not protected by a Subresource Integrity (`integrity`) hash. Consequently, applications following this example trust both the package publication channel and CDN delivery infrastructure to provide executable content. If the package account, package release process, or CDN is compromised, altered JavaScript could execute within the consuming application's browser origin. This finding does not establish that the current package or CDN content is malicious. It identifies a supply-chain weakness caused by mutable dependency resolution and absent integrity verification. ### Attack Path 1. An attacker compromises the npm package publisher, release pipeline, or relevant CDN delivery path. 2. The attacker publishes or serves a modified release of `@baidumap/jsapi-ui-kit`. 3. A developer follows the documented unversioned npm command or uses the unversioned UNPKG URL. 4. The package manager or CDN resolves the attacker-controlled version. 5. The modified JavaScript executes when the application is built or when a user loads the affected page. 6. The payload operates with the browser privileges available to scripts in that application origin. ### Impact Assess ...[truncated 718 chars]- Remediation
View remediation
``` 4. Generate integrity hashes from independently verified release artifacts rather than copying unverified hashes from the same delivery channel. 5. Prefer self-hosting reviewed static artifacts where operationally practical. 6. Use dependency scanning, package provenance verification, and controlled upgrade reviews before changing pinned versions. 7. Apply a restrictive Content Security Policy to reduce the impact of a compromised browser dependency. ]]>