T08 · Insecure Dependencies
Warning
- Location
- scripts/check-prisma-migrate.sh:34
- Finding
- Unpinned Prisma Package Download and Execution via npx## Vulnerability Details **File Location**: `scripts/check-prisma-migrate.sh`, line 34 **Vulnerability Type**: Supply-chain risk caused by automatic execution of an unpinned dependency **Risk Level**: Medium **Vulnerable Code**: ```bash STATUS_OUTPUT="" if ! STATUS_OUTPUT="$(npx --yes prisma migrate status --schema "$SCHEMA_PATH" 2>&1)"; then echo "$STATUS_OUTPUT" fail "prisma migrate status failed" fi ``` ### Technical Analysis The script invokes `npx --yes prisma` without specifying a reviewed package version or requiring a lockfile-installed local binary. If Prisma is not already installed locally, `npx --yes` may automatically retrieve and execute the package resolved through the active npm registry and npm configuration. This makes the code executed by the guard dependent on mutable external package resolution rather than solely on the audited project contents. The effective executable can change after this Skill has been reviewed. A compromised registry, malicious package release, altered npm registry configuration, or dependency-resolution attack could therefore cause attacker-controlled package lifecycle or runtime code to execute. The command is run during a deployment or CI preflight check, where the process is expected to have access to the selected database URL environment variable and potentially other deployment credentials. ### Attack Path 1. An attacker compromises or influences the npm registry, Prisma package release, or npm configuration used by the CI/deployment environment. 2. The expected local Prisma executable is absent, causing `npx` to resolve the package remotely. 3. The migration guard executes `npx --yes prisma migrate status` without a pinned version or interactive confirmation. 4. `npx` downloads and executes the attacker-influenced package. 5. Malicious package code runs with the permissions, environment variables, network access, and filesystem access of the CI or deployment ac ...[truncated 902 chars]
- Remediation
- ## Remediation Suggestions 1. Declare a reviewed, exact Prisma version in the project dependencies and commit the associated lockfile. 2. Install dependencies in CI using an immutable or frozen-lockfile mode, such as `npm ci`. 3. Invoke the lockfile-installed binary directly: ```bash ./node_modules/.bin/prisma migrate status --schema "$SCHEMA_PATH" ``` 4. Alternatively, use `npx --no-install prisma ...` where supported so execution fails instead of downloading a missing package. 5. Configure an approved npm registry and enforce package integrity and provenance controls. 6. Run the guard under a least-privileged account with access only to the database and files required for migration-status inspection. 7. Limit secrets exposed to the CI step and restrict unnecessary outbound network access after dependencies have been installed.