T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Unpinned Global Installation of a Third-Party CLI## Vulnerability Details **File Location**: `SKILL.md`, lines 27-29 **Vulnerability Type**: Supply-chain exposure through an unpinned third-party dependency **Risk Level**: Medium ```sh npm install -g @fetchproxy/cli # provides `fpx` fpx profile add booli --domain booli.se # only the fetch capability is needed fpx pair -p booli # prints a pair code → approve in Transporter ``` ### Technical Analysis The documented setup installs `@fetchproxy/cli` globally without specifying an exact version or validating package integrity. Consequently, installation resolves to whichever release is current when the command runs. npm packages may execute lifecycle scripts during installation, and the installed CLI subsequently runs with the privileges of the invoking user. The following commands also configure a persistent profile and pair the CLI with the Transporter browser extension. If a future package release, package maintainer account, or distribution path is compromised, malicious package code could execute during installation or later CLI invocations and potentially attempt to misuse the browser bridge. This finding does not establish that the current package is malicious. The risk arises from trusting a mutable, unpinned dependency and granting it access to a persistently paired browser transport. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or a future release of `@fetchproxy/cli`. 2. The user follows the documented command, which installs the latest package version globally without integrity verification. 3. Malicious lifecycle or CLI code executes with the invoking user's local privileges. 4. The user creates the `booli` profile and approves browser-extension pairing. 5. The compromised CLI attempts to access local user data, alter its global installation, or misuse the paired browser bridge within the permissions exposed by the extension and approved site access. ### Impact Assessment ...[truncated 595 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@fetchproxy/cli` to an exact, reviewed version rather than installing the latest release: ```sh npm install -g @fetchproxy/cli@<reviewed-exact-version> ``` 2. Publish and verify the expected npm integrity hash or package archive checksum through a trusted channel. 3. Prefer a project-local dependency with a committed lockfile over a global installation, where operationally possible. 4. Review package provenance, publisher identity, lifecycle scripts, and release changes before upgrading. 5. Consider installing with lifecycle scripts disabled when the reviewed package does not require them: ```sh npm install --ignore-scripts @fetchproxy/cli@<reviewed-exact-version> ``` 6. Run the CLI under a minimally privileged user and limit the browser extension's site access to `booli.se`. 7. Document how to revoke the Transporter pairing and remove the profile when it is no longer needed. 8. Require explicit review and reapproval before changing the pinned version.