T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, line 13 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ```bash npm install -g @wenyan-md/cli ``` ### Technical Analysis The installation command retrieves the current version of `@wenyan-md/cli` without pinning an exact, audited release or verifying package integrity or provenance. Because npm packages and their transitive dependencies can execute lifecycle scripts during installation, a compromised package release, maintainer account, or dependency could cause arbitrary code to run with the privileges of the user invoking npm. The `-g` option installs the package globally, increasing its system-wide influence and placing the `wenyan` executable in the user's global command path. The reviewed project contains neither the package source nor a lockfile or integrity metadata that would make the downloaded implementation reproducible and auditable. This finding identifies supply-chain exposure in the documented installation procedure. It does not establish that the named package is currently malicious. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or a transitive dependency and publishes a malicious release. 2. A user follows the documented command after that release becomes the version selected by npm. 3. npm downloads the mutable package version and dependency tree. 4. Malicious package code or an installation lifecycle script executes with the invoking user's privileges. 5. The globally installed command can subsequently execute attacker-controlled behavior whenever the user invokes `wenyan`. ### Impact Assessment Successful exploitation could allow arbitrary code execution under the installing user's account. Depending on that account's permissions, the attacker could access user-readable files and credentials, alter files, make network requests, or install a spoofed global `we ...[truncated 290 chars]
- Remediation
- ## Remediation Suggestions - Pin the dependency to an exact version that has been reviewed, rather than implicitly installing the latest release. - Prefer a project-local installation recorded in `package.json` and a committed lockfile over global installation. - Use reproducible installation commands such as `npm ci` where applicable. - Verify npm package provenance, publisher identity, release signatures, and registry integrity metadata before installation. - Review the package and transitive dependency lifecycle scripts before approving upgrades. - Run installation and publishing operations under a dedicated, non-privileged account with access limited to the required article files and credentials. - Avoid using `sudo` or an administrator account for npm installation. - Establish an allowlisted dependency update process with security review and automated vulnerability scanning.