T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:82
- Finding
- Unpinned Global Installation of a Third-Party CLI## Vulnerability Details **File Location**: `SKILL.md`, line 82 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ```sh npm install -g @fetchproxy/cli # provides `fpx` ``` ### Technical Analysis The setup instructions install the latest available version of `@fetchproxy/cli` globally without an exact version pin, integrity constraint, signature verification, or documented provenance check. An npm installation may execute package lifecycle scripts with the permissions of the user running npm. Although the `fpx` tool is needed for the declared browser-cookie capture workflow, a mutable global installation exceeds the minimum-risk deployment model. A compromised publisher account, malicious future release, or registry compromise could cause different code to execute than the code originally reviewed. Global installation also exposes the package more broadly than a project-local dependency. The audit did not establish that the current package is malicious. The vulnerability is the unsafe supply-chain installation pattern. ### Attack Path 1. An attacker compromises the package publisher, package repository, or release process. 2. The attacker publishes a malicious version under the legitimate package name. 3. A user follows the Skill instructions and runs the unpinned global installation command. 4. npm resolves the mutable latest version and downloads the malicious package. 5. Malicious lifecycle or runtime code executes with the installing user's permissions. 6. The code may access local files, environment credentials, browser-session material, or other resources available to that user. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user running npm. The affected scope may include user-accessible files, shell credentials, environment variables, browser-related data, and network resources ...[truncated 188 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@fetchproxy/cli` to a reviewed exact version rather than installing the mutable latest release. 2. Document the package's official registry and source repository so users can verify provenance. 3. Record and verify package integrity metadata or a trusted release signature where available. 4. Prefer a project-local installation and invoke the pinned binary from that controlled environment. 5. Disable npm lifecycle scripts during installation when the package can operate without them; otherwise, explicitly review the required scripts. 6. Avoid elevated installation privileges and explain that the command must not be run with `sudo`. 7. Periodically review the pinned dependency before intentionally upgrading it.