T08 · Insecure Dependencies
- Location
scripts/smoke_check.sh:29- Finding
Unpinned Third-Party npm Package Is Downloaded and Executed
- Content
View full analysis
Vulnerability Details
File Location:
scripts/smoke_check.sh:4, 29-32; also documented inSKILL.md:25-26, 83andreferences/command-map.md:22-23, 366-367
Vulnerability Type: Supply-chain exposure through an unpinned executable dependency
Risk Level: MediumVulnerable Code
bash PKG_NAME="${AIHEAL_NPM_PACKAGE:-aihealingmecli}" CACHE_DIR="${AIHEAL_NPM_CACHE_DIR:-${TMPDIR:-/tmp}/aiheal-cli-npm-cache-${UID}}"bash if command -v aiheal >/dev/null 2>&1; then echo "[smoke] using global aiheal binary" run_cli_checks aiheal else mkdir -p "${CACHE_DIR}" echo "[smoke] using npx package ${PKG_NAME}" run_cli_checks env NPM_CONFIG_CACHE="${CACHE_DIR}" npx -y -p "${PKG_NAME}" aiheal fiThe corresponding installation guidance in
SKILL.mdis:markdown - Global runtime: `npm install -g aihealingmecli` then `aiheal ...`. - No-global runtime: `npx -y -p aihealingmecli aiheal ...`.Technical Analysis
The Skill downloads and executes
aihealingmecliwithout pinning an exact, reviewed version or verifying artifact integrity. Thenpx -yoption permits unattended package resolution, installation, and execution. Consequently, the code that runs can change after this Skill has been reviewed.The
AIHEAL_NPM_PACKAGEenvironment variable additionally permits the package specification to be replaced with another npm source or tarball. Although this override may support legitimate testing, the script applies no package-name allowlist, exact-version requirement, checksum validation, or trusted-source restriction.The package implementation is not included in the audited project. Therefore, this finding does not assert that the current package is malicious; it identifies that the project delegates execution to a mutable and unverifiable supply-chain component.
Attack Path
- An attacker compromises the npm publisher account, publishes a malicious future release, influences dependency resolution, or causes an unsafe ...[truncated 1457 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin the dependency to an exact reviewed version, for example
aihealingmecli@X.Y.Z, in both the script and documentation. - Commit package-lock or equivalent integrity metadata where practical, and install with a deterministic mechanism such as
npm ci. - Verify the downloaded artifact against an approved integrity hash or signed provenance before execution.
- Avoid automatic execution of a mutable package through
npx -y; install and review the approved artifact separately. - Remove
AIHEAL_NPM_PACKAGEif arbitrary package substitution is unnecessary. Otherwise:- Validate it against an explicit allowlist.
- Require an exact version.
- Reject URLs, Git sources, local paths, and unapproved tarballs.
- Disable npm lifecycle scripts with
--ignore-scriptswhere compatible, while recognizing that this does not make untrusted runtime code safe. - Run the CLI in a sandbox with minimal filesystem, network, credential, and environment-variable access.
- Audit the source and published contents of the pinned package before deployment, including lifecycle scripts and transitive dependencies.
- Ensure the global-binary path also verifies the installed binary's expected version and origin before use.
- Pin the dependency to an exact reviewed version, for example