T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:43
- Finding
- External Executable Dependencies Installed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:43-51`, `SKILL.md:1744-1762` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @maton/cli@0.3.1 ``` ```bash brew install maton-ai/cli/maton brew pin maton ``` ```bash pip install 'maton-ai==0.3.1' ``` ```bash npm install @maton/sdk@0.3.1 ``` The SDK examples subsequently import and execute the installed packages: ```python from maton_ai import Maton, login # login() maton = Maton() # maton = Maton(api_key="...") result = maton.api.get("fastmail", "/jmap/session") ``` ```javascript import { Maton, login } from "@maton/sdk"; // await login() const maton = new Maton(); // const maton = new Maton({ apiKey: "..." }); const result = await maton.api.get("fastmail", "/jmap/session"); ``` ### Technical Analysis The Skill instructs users to install executable CLI and SDK packages from npm, PyPI, and a custom Homebrew tap. Package versions are pinned for npm, PyPI, and the SDK examples, which reduces accidental version drift, but the project provides no checksums, signed artifact verification, lockfiles with integrity metadata, or other provenance controls. A version constraint does not ensure that the retrieved artifact is identical to the artifact reviewed for this Skill. A registry account compromise, package replacement, malicious release, or compromised custom tap could cause users to install attacker-controlled code under the expected package name. The Homebrew instructions present an additional reproducibility concern: `brew pin maton` pins the build only after installation. The command does not establish that the installed formula corresponds to the reviewed CLI version. Because the CLI and SDK handle authenticated Maton operations and private Fastmail data, compromise of these dependencies would cross a sensitive trust boundary. ### Attack Path 1. An attacker compromises a package publisher account, registry art ...[truncated 1569 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Publish immutable checksums** - Provide SHA-256 hashes for every supported CLI and SDK artifact. - Verify downloaded artifacts against those hashes before installation or execution. 2. **Use signed releases** - Sign release artifacts with a documented signing identity. - Require signature verification and document how users can validate the signer. 3. **Make Homebrew installation reproducible** - Provide an immutable, versioned formula or install from a pinned tap commit. - Verify the formula and downloaded binary checksum before execution. - Do not rely on `brew pin` as artifact-integrity verification. 4. **Add dependency lock and integrity metadata** - Supply Python requirements with hashes, such as a hash-locked requirements file. - Supply npm lockfiles containing resolved versions and integrity values where SDK examples are intended to become projects. - Use immutable package versions and prevent unintended dependency resolution. 5. **Reduce installation privileges** - Avoid global npm installation where practical. - Recommend isolated Python virtual environments and project-local JavaScript dependencies. - Run installation and API operations as a non-administrative user. 6. **Document reviewed provenance** - Identify the exact package versions, release hashes, source commits, and build process reviewed with the Skill. - Provide a reproducible-build or software-bill-of-materials record where possible. 7. **Harden credential exposure** - Continue preferring operating-system credential storage and OAuth. - Ensure child processes, lifecycle scripts, and unrelated plugins cannot inherit long-lived API keys. - Rotate Maton credentials immediately if dependency compromise is suspected. ]]>