T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:20
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, line 20 **Vulnerability Type**: Unpinned package execution and supply-chain exposure **Risk Level**: Medium **Vulnerable code:** ```bash npx -y @just-every/crawl "https://help.aliyun.com/zh/model-studio/models" > alicloud-model-studio-models.md ``` ### Technical Analysis The documented workflow invokes `npx` with the `-y` option and an unversioned third-party npm package. This causes npm to resolve the package version from the configured registry, download it when necessary, and execute it without an interactive confirmation prompt. Because neither an exact version nor an integrity value is specified, the code executed by this command can change after the Skill has been reviewed. A malicious or compromised future release of `@just-every/crawl`, one of its transitive dependencies, or the relevant registry delivery path could therefore result in arbitrary local code execution. This is classified as `T08: Insecure Dependencies` rather than confirmed embedded malicious code because the repository does not contain evidence that the current package is malicious. The vulnerability is the unsafe, mutable dependency execution mechanism. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, a transitive dependency, or the package distribution path. 2. The attacker publishes or serves a malicious version that is selected by unversioned npm resolution. 3. A user follows the workflow in `SKILL.md`. 4. `npx -y` downloads the selected package and suppresses the installation confirmation. 5. npm executes package or lifecycle code under the invoking user's account. 6. The malicious code can access resources available to that account and alter files or execute additional processes. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the user running the workflow. The accessible scope may include t ...[truncated 410 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@just-every/crawl` to an audited exact version rather than allowing mutable latest-version resolution. 2. Declare the package in a dedicated `package.json` and commit a lockfile containing resolved versions and integrity hashes. 3. Install dependencies in a separate, reviewable step using a lockfile-enforcing command such as `npm ci`. 4. Avoid automatic confirmation flags for ad hoc remote package execution. Invoke the locally installed, pinned executable instead. 5. Review the package and its transitive dependency tree before upgrades, and use automated dependency and provenance checks where available. 6. Run the crawler with minimal filesystem, credential, and network access, preferably inside an isolated container or sandbox. 7. A hardened workflow could take the following form: ```bash npm ci --ignore-scripts ./node_modules/.bin/crawl "https://help.aliyun.com/zh/model-studio/models" \ > alicloud-model-studio-models.md ``` If the package requires lifecycle scripts, review them explicitly before removing `--ignore-scripts`.