T08 · Insecure Dependencies
Warning
- Location
SKILL.md:22- Finding
Unpinned packages are executed through npx
- Content
View full analysis
&& npx vercel ls --limit 5 # 2. Check team/plan tier npx vercel team ls ``` `docs/checklist.md:170-173`: ```bash # Check for duplicates npx depcheck # Find unused dependencies npx npm-check # Interactive update/remove ``` `docs/general.md:274-276`: ```json { "ignoreCommand": "npx turbo-ignore" } ``` ### Technical Analysis The Skill instructs users and automated Vercel builds to invoke packages through `npx` without specifying reviewed versions. If a package is not already installed locally, `npx` can retrieve and execute it from the configured package registry. This introduces a mutable supply-chain boundary: the code executed during a later Skill invocation may differ from the code available when the Skill was audited. The risk is particularly significant for `npx turbo-ignore` because it may execute as part of Vercel's ignored-build decision rather than only during an explicit local audit. No evidence establishes that the named packages are currently malicious. The vulnerability is the unsafe execution pattern and its exposure to future package compromise, registry compromise, or unexpected dependency resolution. ### Attack Path 1. An attacker compromises a referenced package, one of its transitive dependencies, or the package registry resolution path. 2. A user follows the Skill, or Vercel evaluates the configured `ignoreCommand`. 3. `npx` resolves and downloads the unpinned package version. 4. The package's executable or installation lifecycle code runs with the privileges of the local user, CI runner, or Vercel build environment. 5. Malicious code reads accessible source files, environment variables, package-manager credentials, or ...[truncated 659 chars]- Remediation
View remediation