T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:100
- Finding
- Unpinned npm Package Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, line 100 **Vulnerability Type**: Unsafe execution of a mutable third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash npx create-expo-app@latest my-app --template blank-typescript ``` ### Technical Analysis The project setup instructions direct users to execute `create-expo-app` using the mutable `latest` npm distribution tag. The `npx` command can download the selected package from the configured npm registry and immediately execute its code with the privileges of the invoking user. The `latest` tag can be reassigned and does not identify a fixed, previously reviewed package version. Consequently, the effective code executed by this instruction may change after the Skill has been audited. Although invoking project-generation tooling is necessary for the declared React Native and Expo development functionality, using an unpinned release is not necessary and introduces avoidable supply-chain risk. This issue does not demonstrate that `create-expo-app` is currently malicious. The vulnerability is the instruction to trust and execute a mutable upstream package without version pinning or provenance verification. ### Attack Path 1. An attacker compromises the upstream package, a maintainer account, the package publication process, or the npm registry path used by the victim. 2. The attacker publishes a malicious release and causes the mutable `latest` tag to resolve to it. 3. A user follows the Skill's initialization instructions and runs the documented `npx` command. 4. `npx` downloads the attacker-controlled package version and executes its project-generation code. 5. The malicious package operates with the user's current privileges and can access resources available to that user and process. ### Impact Assessment Successful exploitation permits arbitrary code execution under the account running the command. Depending on the local environment a ...[truncated 525 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the mutable `latest` tag with an exact, reviewed version, for example: ```bash npx create-expo-app@X.Y.Z my-app --template blank-typescript ``` 2. Periodically review and deliberately update the pinned version rather than allowing the selected release to change implicitly. 3. Instruct users to verify that the package resolves from the official npm registry and confirm its publisher, provenance, and expected package metadata before execution. 4. Where organizational controls are available, use an approved internal registry proxy, dependency allowlist, or package provenance policy. 5. Run project-generation tools in an isolated development environment with no unnecessary credentials and only the filesystem permissions required to create the target project. 6. Avoid running the initialization command as an administrator or root user.