T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:22
- Finding
- Unpinned packages are executed through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:22-26`, `docs/checklist.md:170-173`, `docs/general.md:274-276` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code `SKILL.md:22-26`: ```bash # 1. Check current build times cd <project> && npx vercel ls --limit 5 # 2. Check team/plan tier npx vercel team ls ``` `docs/checklist.md:170-173`: ```bash # Check for duplicates npx depcheck # Find unused dependencies npx npm-check # Interactive update/remove ``` `docs/general.md:274-276`: ```json { "ignoreCommand": "npx turbo-ignore" } ``` ### Technical Analysis The Skill instructs users and automated Vercel builds to invoke packages through `npx` without specifying reviewed versions. If a package is not already installed locally, `npx` can retrieve and execute it from the configured package registry. This introduces a mutable supply-chain boundary: the code executed during a later Skill invocation may differ from the code available when the Skill was audited. The risk is particularly significant for `npx turbo-ignore` because it may execute as part of Vercel's ignored-build decision rather than only during an explicit local audit. No evidence establishes that the named packages are currently malicious. The vulnerability is the unsafe execution pattern and its exposure to future package compromise, registry compromise, or unexpected dependency resolution. ### Attack Path 1. An attacker compromises a referenced package, one of its transitive dependencies, or the package registry resolution path. 2. A user follows the Skill, or Vercel evaluates the configured `ignoreCommand`. 3. `npx` resolves and downloads the unpinned package version. 4. The package's executable or installation lifecycle code runs with the privileges of the local user, CI runner, or Vercel build environment. 5. Malicious code reads accessible source files, environment variables, package-manager credentials, or ...[truncated 659 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Add required audit tools and the Vercel CLI as development dependencies using explicitly reviewed versions. 2. Commit the corresponding lockfile and require immutable installation: ```bash pnpm install --frozen-lockfile ``` 3. Invoke locally installed executables rather than allowing network installation: ```bash pnpm exec vercel ls --limit 5 pnpm exec depcheck ``` 4. If `npx` must be retained, specify an exact version and prevent fallback installation where practical: ```bash npx --no-install vercel ls --limit 5 ``` 5. Replace `npx turbo-ignore` in persistent deployment configuration with a project-local, lockfile-controlled command. 6. Review package provenance, lifecycle scripts, maintainers, and transitive dependencies before approving version updates. 7. Run dependency-audit utilities without production secrets and with minimum filesystem and network privileges. ]]>