T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:31
- Finding
- Third-Party Package Installation Without Artifact Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31-46`, `SKILL.md:1315`, and `SKILL.md:1330` **Vulnerability Type**: Supply-chain exposure through executable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installation ### NPM ```bash npm install -g @maton/cli@0.3.1 ``` ### Homebrew ```bash brew install maton-ai/cli/maton brew pin maton ``` ``` The optional SDK installation instructions introduce the same dependency trust boundary: ```bash pip install 'maton-ai==0.3.1' ``` ```bash npm install @maton/sdk@0.3.1 ``` ### Technical Analysis The Skill directs the agent or user to install executable packages from npm, PyPI, and a vendor-controlled Homebrew tap. Package installation can execute package-controlled lifecycle hooks, build scripts, and binaries with the privileges of the invoking user. The global npm installation has a wider system impact than a project-local or isolated installation. The dependencies are version-pinned, which limits unexpected upgrades and is preferable to unconstrained installation. However, version pinning alone does not authenticate package contents or protect against: - Compromise of a package registry account or vendor-controlled tap. - Replacement or mutation of published artifacts. - A malicious or compromised transitive dependency. - Installation of an artifact whose source and build provenance have not been independently verified. - Package lifecycle scripts executing during installation. The audit found no evidence that the named packages are currently malicious, and no remote shell pipeline such as `curl | sh` is present. This finding concerns the unverified supply-chain execution boundary created by the documented installation process. ### Attack Path 1. An attacker compromises the publisher account, package release process, package registry entry, Homebrew tap, or a transitive dependency. 2. The attacker publishes or substitutes a malicious artifact under a p ...[truncated 1419 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Publish SHA-256 hashes or signed checksums for each reviewed CLI and SDK artifact, and verify them before installation. 2. Provide package-signing or provenance verification instructions, such as Sigstore attestations or an equivalent trusted release-signing mechanism. 3. Prefer project-local or isolated installations over global installation: - Use a dedicated Python virtual environment. - Use a locked npm project or isolated package execution environment. - Avoid administrative privileges. 4. Commit lockfiles containing resolved transitive dependencies and integrity metadata for SDK examples intended for application use. 5. Audit package lifecycle scripts and document whether installation can safely use options that disable unnecessary scripts. 6. Pin the Homebrew formula to an immutable, reviewed revision where feasible rather than relying only on `brew pin` after retrieving the formula from a mutable tap. 7. Document the verified publisher identities and official registry/tap URLs so users can detect typosquatting or dependency confusion. 8. Perform dependency vulnerability and provenance scanning for every release, and require explicit review before changing pinned versions. ]]>