T08 · Insecure Dependencies
Note
- Location
- README.md:34
- Finding
- Unpinned npx Installation Command Introduces Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, line 34 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Low ### Vulnerable Code ```bash npx skills add CalmDownTR/job-screener-engine ``` ### Technical Analysis The documented installation procedure invokes `npx skills` without pinning the `skills` package to a reviewed version or validating its integrity. When the package is not already available locally, `npx` can retrieve and execute a package selected from the configured npm registry. Consequently, the code executed during installation may differ over time from the version reviewed by users or maintainers. Exploitation would require compromise or malicious replacement of the relevant npm package, registry, package publisher account, or registry configuration. The audit found no evidence that the current package is malicious; the issue is the absence of version and integrity controls around executable third-party installation tooling. ### Attack Path 1. An attacker compromises the publisher account or distribution channel for the unpinned `skills` package, or causes the victim's npm configuration to resolve it from an attacker-controlled registry. 2. The attacker publishes a malicious version that contains lifecycle scripts or malicious command-line behavior. 3. A user follows the README and runs `npx skills add CalmDownTR/job-screener-engine`. 4. `npx` retrieves the attacker-controlled version because the command does not specify a trusted version or integrity value. 5. The malicious package executes with the permissions of the user running the installation command. ### Impact Assessment Successful exploitation could execute arbitrary code under the installing user's account. Depending on that account's permissions and environment, this could expose source code, local credentials, environment variables, SSH or package-manager credentials, and files writable by the user. It could also modify the user's ...[truncated 243 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Pin the installer to a specific reviewed version, for example: ```bash npx skills@X.Y.Z add CalmDownTR/job-screener-engine ``` - Document the expected package publisher, registry, and version so users can verify package provenance before execution. - Prefer a lockfile-backed installation workflow where practical. - Publish and verify package integrity hashes or signed release artifacts. - Recommend that users inspect the resolved package and disable unnecessary lifecycle scripts when supported. - Use automated dependency monitoring and require multi-factor authentication and trusted publishing for package publisher accounts. ]]>