T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:26
- Finding
- Unpinned Global Installation of a Privileged Browser-Relay Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:26` **Vulnerability Type**: Supply-chain exposure through an unpinned dependency **Risk Level**: Medium ### Vulnerable Code ```sh npm i -g @fetchproxy/cli # also needs the Transporter Chrome extension ``` ### Technical Analysis The setup instructions install the latest available version of `@fetchproxy/cli` globally without an exact version pin, lockfile, package-integrity check, or documented verification procedure. This dependency is particularly sensitive because it participates in a persistent browser relay that sends authenticated requests through a signed-in MyAtriumHealth tab. According to the Skill documentation, the associated profile receives access to authentication cookies and relays requests that can return protected health information. Although the audited files contain no evidence that the current package is malicious, installing an unpinned latest release means the code executed by future users may differ from the version that was reviewed. A compromised package publisher, registry account, release pipeline, or newly published malicious version could therefore affect the trusted browser-session relay. ### Attack Path 1. An attacker compromises the npm package, maintainer credentials, or release process for `@fetchproxy/cli`. 2. The attacker publishes a malicious version under the legitimate package name. 3. A user follows the Skill instructions and runs `npm i -g @fetchproxy/cli`. 4. npm installs the attacker-controlled latest version globally. 5. The user pairs the CLI with the Transporter browser extension and creates the MyAtriumHealth profile. 6. The compromised dependency observes, alters, or redirects authenticated operations handled through the browser relay. 7. Protected health information or security material available to the relay may be exposed within the dependency's effective privileges. ### Impact Assessment Successful exploitation could affect the ...[truncated 527 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@fetchproxy/cli` to an exact, reviewed version rather than installing the latest release: ```sh npm install --global @fetchproxy/cli@<reviewed-version> ``` 2. Document the expected package publisher, official registry, and approved Transporter extension source. 3. Publish and verify expected package integrity information or signed release artifacts where supported. 4. Prefer a project-local installation with a committed lockfile over a global installation: ```sh npm install --save-exact @fetchproxy/cli@<reviewed-version> ``` 5. Invoke the locked local binary rather than relying on an unrestricted global executable. 6. Re-audit dependency updates before changing the pinned version. 7. Document how users can revoke the persistent browser pairing and remove the profile after use. ]]>