T08 · Insecure Dependencies
Warning
- Location
- references/setup.md:8
- Finding
- Unpinned Global Installation of a Security-Sensitive npm Dependency<![CDATA[ ## Vulnerability Details **File Location**: `references/setup.md:8-11`; related installer metadata at `SKILL.md:16-25` **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code `references/setup.md:8-11`: ```bash npm install -g @googleworkspace/cli ``` Related package metadata in `SKILL.md:16-25`: ```json "install": [ { "id": "npm", "kind": "npm", "package": "@googleworkspace/cli", "global": true, "bins": ["gws"], "label": "Install gws CLI (npm)" } ] ``` ### Technical Analysis The Skill installs the latest version of `@googleworkspace/cli` without pinning a reviewed version or enforcing package integrity. The installation is global, increasing its effect beyond this project and exposing every process using the same npm prefix to the installed executable. An npm package or one of its transitive dependencies can execute lifecycle scripts during installation. Because the package version is unresolved until installation time, its effective implementation may change after this Skill has been audited. This creates a supply-chain trust gap even though the documented package name and linked repository are consistent with the declared Google Workspace CLI. The risk is amplified because the installed CLI is subsequently given access to sensitive Google Workspace OAuth credentials and data. No evidence establishes that the current package is malicious; the vulnerability is the absence of version and integrity controls. ### Attack Path 1. An upstream release, maintainer account, publication process, or transitive dependency is compromised. 2. The attacker publishes a malicious package version under the expected package name or introduces malicious dependency behavior. 3. A user follows the Skill instructions and runs the unpinned global installation. 4. npm resolves the compromised version and may execute its lifecycle code with the installing user's privileges. 5. T ...[truncated 836 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version, for example: ```bash npm install -g @googleworkspace/cli@<reviewed-version> ``` 2. Prefer a project-local installation with a committed lockfile over global installation: ```bash npm install --save-exact @googleworkspace/cli@<reviewed-version> ``` 3. Verify registry provenance, package signatures or attestations where available, and expected package integrity before installation. 4. Review transitive dependencies and npm lifecycle scripts for each upgrade. 5. Disable lifecycle scripts during installation when compatible with the package: ```bash npm install --ignore-scripts --save-exact @googleworkspace/cli@<reviewed-version> ``` 6. Run the CLI as an unprivileged user and avoid `sudo npm install -g`. 7. Document an explicit upgrade-review process rather than silently resolving the latest release each time. ]]>