T08 · Insecure Dependencies
Error
- Location
Readme.md:27- Finding
Unpinned Remote Dependencies Executed During Installation
- Content
View full analysis
Vulnerability Details
File Location:
Readme.md:27-30
Vulnerability Type: Unpinned third-party package and mutable GitHub dependency
Risk Level: HighComplete Code Snippet:
markdown ### Install coinw-skills Run the following command to add coinw-skills to your project: ```bash npx skills add https://github.com/connectCoinw/coinw-skillstext ### Technical Analysis The installation command invokes `npx` without pinning the `skills` package to a specific version. Depending on the local environment, `npx` may download and execute the current package version from the npm registry. The GitHub repository is also referenced without an immutable commit hash or signed release identifier. Consequently, the code executed during installation is not fully determined by the audited project contents. A later package update, compromised publisher account, repository compromise, or malicious dependency substitution could alter the effective installation payload after review. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the referenced GitHub repository, or a relevant supply-chain component. 2. The attacker publishes or commits a malicious payload under the mutable package or repository reference. 3. A user follows the documented installation command. 4. `npx` retrieves and executes the current package version, which processes content from the mutable repository reference. 5. The malicious payload executes with the privileges of the user running the command. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's privileges and environment, an attacker could access project files, environment variables, CoinW API credentials, local credential stores, or other user-accessible resources. The project does not itself contain the remote payload, so the final impact depends on wha ...[truncated 40 chars]- Remediation
View remediation
Remediation Suggestions
- Pin the npm utility to a reviewed version, such as
npx skills@<exact-version>. - Pin the GitHub source to an immutable commit hash rather than a mutable branch or repository head.
- Prefer signed release artifacts and publish their cryptographic checksums.
- Use a lockfile and integrity metadata for all transitive dependencies.
- Run installation in a restricted environment without production credentials.
- Document a process for verifying package signatures, commit provenance, and artifact hashes before installation.
- Pin the npm utility to a reviewed version, such as