T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:7
- Finding
- Execution of Unpinned Third-Party npm Packages## Vulnerability Details **File Location**: `SKILL.md:7`; `references/tui-patterns.md:8`, `references/tui-patterns.md:26`, and `references/tui-patterns.md:42` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium The Skill recommends installing or executing npm packages without pinning them to reviewed versions. **Relevant code snippets:** `SKILL.md:7` ```yaml compatibility: Requires Node.js >= 18 and clrun installed (npm install -g clrun or npx clrun). ``` `references/tui-patterns.md:6-8` ```bash # 1. Start the scaffolder clrun "npx create-vue@latest" ``` `references/tui-patterns.md:24-26` ```bash # 6. Install dependencies and start dev server clrun <id> "cd my-vue-app && npm install" ``` `references/tui-patterns.md:40-42` ```bash # 1. Start scaffolder clrun "npx create-vite@latest" ``` ### Technical Analysis Bare `npx clrun`, `npm install -g clrun`, and package specifiers using `@latest` resolve package contents at execution time rather than using an immutable, previously reviewed version. The effective code can therefore change after the Skill itself has been audited. npm packages may execute JavaScript through their CLI entry points and lifecycle scripts. The subsequent `npm install` also installs dependencies from a newly generated manifest and may run their lifecycle scripts. If the relevant package, maintainer account, transitive dependency, or package-distribution channel is compromised, following these instructions can execute attacker-controlled code. No evidence establishes that the named packages are currently malicious. The vulnerability is the Skill's reliance on mutable, unverified supply-chain inputs. ### Attack Path 1. An attacker compromises a referenced npm package, its maintainer account, or a transitive dependency and publishes a malicious release. 2. Because the instructions use a bare package name or `@lates ...[truncated 1078 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every directly executed npm package to an exact reviewed version instead of using bare names or `@latest`. 2. Replace examples such as `npx create-vue@latest` with an exact version, for example `npx create-vue@X.Y.Z`, after reviewing that release. 3. Avoid global package installation where possible. Use a project-local, exact-version dependency with a committed lockfile. 4. Commit and enforce lockfiles, and use `npm ci` rather than unconstrained `npm install` for reproducible installation. 5. Verify package provenance and integrity using registry integrity metadata, trusted publication information, and organizational package allowlists. 6. Review direct and transitive dependencies before updating pinned versions. 7. Disable lifecycle scripts with `--ignore-scripts` when they are unnecessary. If scripts are required, inspect them before execution. 8. Run scaffolders and dependency installation in an isolated, least-privileged environment without production credentials or access to sensitive host directories. 9. Document the exact approved package names and versions to reduce dependency-confusion and typosquatting exposure.