T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:38
- Finding
- Unpinned Third-Party CLI and SDK Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:38-42`, `SKILL.md:697`, and `SKILL.md:711` **Vulnerability Type**: Supply-chain exposure through unpinned dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:38` ```bash npm install -g @maton/cli ``` `SKILL.md:42` ```bash brew install maton-ai/cli/maton ``` `SKILL.md:697` ```bash pip install maton-ai ``` `SKILL.md:711` ```bash npm install @maton/sdk ``` ### Technical Analysis The installation instructions do not pin the Maton CLI or SDK packages to reviewed versions and do not specify integrity hashes. Consequently, executing these commands resolves mutable package versions from third-party package registries or a Homebrew tap at installation time. The global NPM installation is especially sensitive because package lifecycle scripts and installed binaries execute with the privileges of the user performing the installation. The Python and JavaScript SDK instructions have similar supply-chain exposure when used without lockfiles, hashes, or exact versions. This does not establish that the named packages are currently malicious. The weakness is that the code executed by users can change after the Skill has been reviewed. A compromised publisher account, registry, package release, or Homebrew tap could therefore introduce attacker-controlled code without any corresponding change to `SKILL.md`. The separately flagged transmission of `MATON_API_KEY` to `https://api.maton.ai` is not treated as a vulnerability. It is disclosed authentication behavior necessary for the optional raw HTTP fallback, is restricted to the declared gateway host, and is accompanied by instructions against printing, persisting, or passing the key through command-line arguments. ### Attack Path 1. An attacker compromises a package publisher account, package registry entry, release pipeline, or the referenced Homebrew tap. 2. The attacker publishes a malicious new version under one of the trusted dependen ...[truncated 1626 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every package to an explicitly reviewed version, for example: - `npm install -g @maton/cli@<reviewed-version>` - `pip install maton-ai==<reviewed-version>` - `npm install @maton/sdk@<reviewed-version>` 2. Provide integrity verification: - Use NPM lockfiles with verified integrity metadata for project-local dependencies. - Use `pip --require-hashes` with a fully hashed requirements file. - Publish and verify checksums or signatures for CLI binaries. - Pin the Homebrew formula or documented release rather than implicitly accepting the latest tap state. 3. Prefer project-local or isolated installation over global installation: - Use a dedicated virtual environment for Python. - Install JavaScript dependencies locally with a committed lockfile. - Run the CLI in a restricted environment where practical. 4. Disable unnecessary package installation scripts or inspect them before execution where package-manager support permits. 5. Document the expected package registry, publisher identity, package namespace, and verified release provenance to reduce dependency-confusion and typosquatting risks. 6. Establish a controlled upgrade process in which new versions are reviewed and tested before the pinned version and integrity metadata are updated. 7. Continue using least-privilege Kibana connections so compromise of a dependency does not automatically grant administrative or production-wide access. ]]>