T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:33
- Finding
- Unpinned npm Dependencies Introduce Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:33-37`; related recommendations at `references/homes-requests.md:163` and `references/homes-requests.md:256` **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code ```sh npm install -g @fetchproxy/cli # provides `fpx` fpx profile add homes --domain homes.com fpx pair -p homes # prints a pair code → approve in Transporter ``` The reference documentation additionally recommends an unpinned parser dependency: ```text npm install node-html-parser ``` ### Technical Analysis The setup instructions install the latest package version resolved by the npm registry rather than a reviewed, immutable version. The primary dependency is installed globally, potentially running npm lifecycle scripts with the invoking user's permissions and placing executable files in a global command path. Because neither an exact version nor an integrity-controlled lockfile is specified, the code ultimately installed can change after this Skill has been audited. This creates exposure to package-account compromise, malicious future releases, dependency confusion within transitive dependencies, and registry compromise. The globally installed `fpx` executable is especially security-sensitive because it is subsequently paired with a browser extension and used to send requests through an authenticated browser tab. ### Attack Path 1. An attacker compromises the maintainer account, release pipeline, or a transitive dependency associated with `@fetchproxy/cli` or `node-html-parser`. 2. The attacker publishes a malicious package version that includes an install-time lifecycle script or modified runtime behavior. 3. A user follows the Skill instructions and runs the unpinned `npm install` command. 4. npm resolves and installs the malicious release. 5. Malicious lifecycle code executes with the user's local privileges, or the modified `fpx` executable gai ...[truncated 670 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin each dependency to an exact, reviewed version, for example: ```sh npm install --global --ignore-scripts @fetchproxy/cli@<reviewed-version> ``` Only use `--ignore-scripts` after confirming the package does not legitimately require installation scripts. 2. Document the expected package publisher, registry, version, and package integrity hash. 3. Prefer a project-local installation with a committed lockfile over a global installation: ```sh npm install --save-exact @fetchproxy/cli@<reviewed-version> npm ci npx fpx ... ``` 4. Pin `node-html-parser` to a reviewed exact version and include it in the same lockfile rather than asking users to install the current latest release. 5. Audit transitive dependencies and npm lifecycle scripts before updating pinned versions. 6. Run the CLI under a dedicated, minimally privileged OS and browser profile when practical. ]]>