T08 · Insecure Dependencies
Warning
- Location
.tape` ``` `examples/web-demo.spec.ts:6-11`: ```typescript // Setup: // npm install -D @playwright/test tsx // npx playwright install chromium // // Run: // npx tsx examples/web-demo.spec.ts ``` `references/web-capture.md:12-13`: ```bash npm install -D @playwright/test npx playwright install chromium ``` `references/tape-cookbook.md:189-197`: ```markdown | Platform | Command | |---|---| | macOS | `brew install vhs` | | Windows | `scoop install vhs` (also installs `ttyd`/`ffmpeg` as dependencies) ...[truncated 4447 chars]:38- Finding
Unpinned Third-Party Dependencies and Mutable Installation Sources
- Content
View full analysis
.tape` ``` `examples/web-demo.spec.ts:6-11`: ```typescript // Setup: // npm install -D @playwright/test tsx // npx playwright install chromium // // Run: // npx tsx examples/web-demo.spec.ts ``` `references/web-capture.md:12-13`: ```bash npm install -D @playwright/test npx playwright install chromium ``` `references/tape-cookbook.md:189-197`: ```markdown | Platform | Command | |---|---| | macOS | `brew install vhs` | | Windows | `scoop install vhs` (also installs `ttyd`/`ffmpeg` as dependencies) or `winget install charmbracelet.vhs` | | Debian/Ubuntu | Not in the default apt repos — add charm's repo first: `curl -fsSL https://repo.charm.sh/apt/gpg.key \| sudo gpg --dearmor -o /etc/apt/keyrings/charm.gpg`, then `echo "deb [signed-b ...[truncated 4107 chars]- Remediation
View remediation
demo.tape ``` - Document the corresponding human-readable version and a process for reviewing digest updates. 3. **Verify downloaded artifacts** - Specify an exact `ttyd` release and verify its published checksum or signature before execution. - Where supported, validate package signatures and checksums against values stored in reviewed documentation. - Avoid downloading installation artifacts based only on a mutable “latest” release URL. 4. **Harden APT repository enrollment** - Require explicit user approval before changing system repository configuration. - Document and verify the expected signing-key fingerprint before adding the key. - Pin the repository package or version where practical. - Separate repository enrollment from installation so users can inspect each privileged command. - Avoid having an agent automatically execute the `sudo` sequence. 5. **Reduce installation privileges** - Prefer user-scoped installations or a disposable development container. - Do not run npm, Go, browser, or recording-tool installation commands as root. - Use a sandbox with only the required project directory mounted and make the mount read-only when output generation does not require writes. 6. **Make `npx` execution deterministic** - Install a pinned local `tsx` dependency first and invoke it through the locked project environment. - Use options and CI controls that prevent unexpect ...[truncated 391 chars]