T08 · Insecure Dependencies
Warning
- Location
install.md:57- Finding
Unpinned Webstudio CLI Execution Can Expose Project Credentials to an Unreviewed Package
- Content
View full analysis
--version npx --yes webstudio@ ``` The later examples do not follow that requirement: ```bash npx webstudio link --link "" ``` ```bash # 1. build locally in the project webstudio build --template docker # produces Dockerfile, package.json, build/ ``` ### Technical Analysis The document correctly establishes that the CLI version must be reviewed and pinned, but subsequent operational examples execute `npx webstudio` without a version and invoke an unqualified `webstudio` command from the local `PATH`. An unversioned `npx` invocation may resolve and download the package version currently selected by the npm registry instead of the previously reviewed version. The effective code can therefore change after this Skill has been audited. The command also receives a Build-access share link, which the Skill itself identifies as a credential. The unqualified `webstudio` invocation introduces a related executable-resolution risk. It may run an unexpected globally installed or locally injected binary if the execution environment does not guarantee the intended reviewed CLI. This behavior is not necessary to the Skill's functionality. The same operations can be completed with a reviewed and explicitly pinned package version. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or a newly selected package release. Alternatively, an attacker places a malicious `webstudi ...[truncated 1356 chars]- Remediation
View remediation
link \ --link "" ``` ```bash npx --yes webstudio@ build --template docker ``` 2. Record the approved version in deployment-controlled configuration and reuse exactly that value for every automated operation. 3. Prefer a lockfile-backed local installation where practical, and verify package integrity through the package manager's lockfile and integrity metadata. 4. Do not resolve the approved version dynamically during privileged or unattended execution. Version discovery and review should occur as a separate trusted process. 5. Avoid relying on an unqualified `webstudio` executable from `PATH`. If a locally installed binary is used, resolve and validate its expected path and version before passing credentials to it. 6. Keep Build-access share links scoped to the minimum required project permissions, inject them ephemerally, prevent them from appearing in logs, and rotate or revoke them if an unreviewed executable may have received them. ]]>