T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:10
- Finding
- Unpinned Third-Party Dependency Receives Account Credentials## Vulnerability Details **File Location**: `SKILL.md:10-15` and `scripts/bring_cli.mjs:2, 35-43` **Vulnerability Type**: Unpinned third-party dependency with access to sensitive credentials **Risk Level**: Medium ### Vulnerable Code `SKILL.md:10-15`: ```markdown Use the `bring-shopping` npm package to access Bring! lists with email/password credentials. Default list is "Willig" unless the user specifies otherwise. ## Quick Start 1. Install dependency in the skill folder: - `npm install bring-shopping` ``` `scripts/bring_cli.mjs:2, 35-43`: ```javascript import Bring from 'bring-shopping'; const mail = process.env.BRING_EMAIL; const password = process.env.BRING_PASSWORD; if (!mail || !password) { console.error('Missing BRING_EMAIL or BRING_PASSWORD environment variables.'); process.exit(1); } const bring = new Bring({ mail, password }); await bring.login(); ``` ### Technical Analysis The installation instructions use `npm install bring-shopping` without an exact dependency version. The project provides no `package.json`, lockfile, integrity metadata, vendored source, or other reproducible dependency control. Consequently, users may install whichever package version and transitive dependency graph the registry resolves at installation time. The imported package executes in the local Node.js process and is explicitly supplied with the user's Bring! email address and plaintext password. Because an npm dependency has the same effective operating-system privileges as the CLI, a compromised or unexpectedly changed package version could inspect credentials, environment variables, shopping-list data, and locally accessible files. It could also perform arbitrary network requests or execute other actions available to the current user. This finding concerns supply-chain trust and reproducibility. The reviewed source does not itself prove that the current `bring-shopping` package is malicious. ### A ...[truncated 1234 chars]
- Remediation
- ## Remediation Suggestions 1. Add a `package.json` declaring an audited, exact `bring-shopping` version rather than a range or unqualified package name. 2. Generate and commit a lockfile so the complete transitive dependency graph and integrity hashes are reproducible. 3. Direct users to install with `npm ci` rather than an unconstrained `npm install bring-shopping`. 4. Verify the expected npm registry, package publisher, source repository, and package integrity before installation. 5. Audit the selected package version and its transitive dependencies, including installation scripts and network behavior. 6. Use automated dependency monitoring and require review before lockfile updates. 7. Prefer an official API and revocable, narrowly scoped authentication token instead of a reusable account password if Bring! supports such authentication. 8. Run the CLI under a dedicated least-privileged account or sandbox with restricted filesystem, environment, process-execution, and network access. 9. Avoid exposing unrelated secrets in the CLI process environment.