T08 · Insecure Dependencies
Warning
- Location
- docx-js.md:8
- Finding
- Unpinned Global Installation of a Third-Party Node.js Dependency## Vulnerability Details **File Location**: `docx-js.md:8-9` **Vulnerability Type**: Unpinned and globally installed third-party dependency **Risk Level**: Medium ### Vulnerable Code ```text Assume docx is installed globally If not installed: `npm install -g docx` ``` ### Technical Analysis The installation instructions retrieve and globally install the latest available version of the `docx` package without an exact version, lockfile, or integrity constraint. Consequently, the dependency resolved during installation may differ from the version reviewed or tested by the Skill author. npm installation can execute package lifecycle scripts. If the package, a transitive dependency, the configured npm registry, or the relevant release channel is compromised, installation may execute attacker-controlled code with the permissions of the user running npm. Global installation also broadens the affected scope beyond an isolated project directory. No malicious dependency is embedded in the audited project, and no currently compromised package was established during this static audit. The vulnerability is the unsafe and mutable dependency acquisition process. ### Attack Path 1. An attacker compromises the `docx` package, one of its transitive dependencies, a future release, or the registry path used by the host. 2. A user follows the Skill documentation and runs `npm install -g docx`. 3. npm resolves the mutable latest package version rather than a previously audited version. 4. Malicious package content or lifecycle scripts execute during installation. 5. The installed module is subsequently loaded by `scripts/generate_docx_from_markdown.cjs`, allowing malicious runtime behavior to continue during document generation. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running npm. Depending on those privileges, the attacker could access or modify files available to tha ...[truncated 361 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the global installation instruction with a project-local dependency. 2. Add a `package.json` that pins an audited exact version of `docx`. 3. Commit a package lockfile and instruct users to run `npm ci` rather than installing the mutable latest version. 4. Avoid version ranges such as `^` or `~` for security-sensitive document-generation dependencies. 5. Verify the expected npm registry and retain lockfile integrity hashes. 6. Disable lifecycle scripts during installation when compatible with the dependency: ```bash npm ci --ignore-scripts ``` 7. Run dependency auditing and provenance verification before publishing the Skill. 8. Remove the recommendation to install the module globally, thereby limiting any compromise to the Skill workspace.