T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:32
- Finding
- Unpinned Global Installation of a Security-Sensitive Third-Party Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32` **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```sh npm install -g @fetchproxy/cli # provides `fpx` ``` ### Technical Analysis The setup instructions install the latest available release of `@fetchproxy/cli` globally without an exact version pin, lockfile, or integrity verification. The CLI is subsequently paired with a browser extension and used to obtain the authenticated `CKAT` and `CKTRKID` Credit Karma cookies. Because no reviewed version is fixed, the code executed by this command can change after the Skill has been audited. npm installation can also execute package lifecycle scripts. Installing globally increases the package's reach beyond an isolated project environment. This is particularly sensitive because the installed CLI is entrusted with browser-session material that can authorize access to private financial information. The audit did not establish that the named package is currently malicious; the vulnerability is the unsafe, mutable supply-chain trust model. ### Attack Path 1. An attacker compromises the package publisher, npm account, package distribution channel, or a future package release. 2. The attacker publishes a malicious version under the same package name. 3. A user follows the Skill instructions and runs the unpinned global installation command. 4. npm downloads the attacker-controlled version and may execute its lifecycle scripts with the user's privileges. 5. The malicious CLI can execute local commands immediately or wait until the user pairs it with the browser extension. 6. Once invoked and paired, it may attempt to capture Credit Karma session cookies or transmit data accessible to the process. ### Impact Assessment Successful exploitation can execute code with the privileges of the user running npm. Depending on local npm configuration and how t ...[truncated 546 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@fetchproxy/cli` to an exact, reviewed version instead of installing the latest release: ```sh npm install --save-exact @fetchproxy/cli@<reviewed-version> ``` 2. Prefer a project-local installation and invoke it through a controlled local path rather than modifying the global npm environment. 3. Commit and enforce a lockfile with integrity hashes. 4. Verify package ownership, provenance, signatures, and published integrity before installation. 5. Review package lifecycle scripts and consider installing with scripts disabled if they are unnecessary: ```sh npm ci --ignore-scripts ``` 6. Run the CLI under a minimally privileged account and grant browser-cookie access only for the required Credit Karma domain and cookie names. 7. Document a reviewed version-upgrade process so dependency changes receive a new security assessment before deployment. ]]>