T08 · Insecure Dependencies
- Location
package.json:17- Finding
Unpinned and Non-Reproducible Credential-Handling Dependency
- Content
View full analysis
Vulnerability Details
File Location:
package.json:17; related lockfile evidence atpackage-lock.json:12,package-lock.json:24-26, andpackage-lock.json:2104-2106
Vulnerability Type: Insecure third-party dependency and unsafe dependency source
Risk Level: HighVulnerable Code
package.json:15-19:json "dependencies": { "bring-shopping": "*", "chalk": "^4.1.2", "commander": "^11.1.0" }package-lock.json:2104-2107:json "node_modules/bring-shopping": { "resolved": "../../skills-temp", "link": true },The dependency receives the user's Bring! credentials in
index.js:6andindex.js:57-65:js const Bring = require('bring-shopping');js const bring = new Bring({ mail: process.env.BRING_EMAIL, password: process.env.BRING_PASSWORD }); try { await bring.login();Technical Analysis
The security-sensitive
bring-shoppingdependency is declared using the unrestricted wildcard version"*". This permits future installations to select package releases that were not reviewed as part of this audit.The lockfile does not mitigate that exposure reliably because it resolves the package to
../../skills-temp, a linked local directory outside the audited project. The implementation of that target is absent from the supplied artifact, and the lockfile entry provides neither an immutable registry artifact nor an integrity hash for this dependency.This dependency is security-critical because the application imports it and directly supplies the user's
BRING_EMAILandBRING_PASSWORDvalues to its constructor before invokinglogin(). Any malicious or substituted implementation would execute within the CLI's Node.js process and could access those credentials, the environment, files available to the user, and the user's network permissions.Attack Path
- An attacker publishes or compromises a future
bring-shoppingrelease accepted by the wildcard constraint, or modifies/su ...[truncated 1468 chars]
- An attacker publishes or compromises a future
- Remediation
View remediation
Remediation Suggestions
- Replace the wildcard dependency with an exact, reviewed version:
json "bring-shopping": "2.0.1"-
Regenerate
package-lock.jsonusing the intended official registry. Verify that the resulting entry records:- An exact version.
- An HTTPS registry URL.
- A package integrity hash.
- No
link: trueor relative external path.
-
Reject local, file-based, Git-based, or workspace-link dependency sources in release artifacts unless they are deliberately vendored and included in the security review.
-
Enforce reproducible installations in CI with
npm ciand fail builds if the lockfile changes unexpectedly. -
Add automated dependency-policy checks that prohibit wildcard versions and unexpected non-registry sources.
-
Review the selected
bring-shoppingrelease, including install scripts, runtime network behavior, credential handling, and transitive dependencies. -
Use a restricted API token instead of an account password if the service supports token-based authentication. Avoid granting third-party libraries long-lived primary credentials where possible.
-
Correct
SKILL.md:145, which says the implementation usesnode-bring-api, so that documentation accurately identifies the dependency that receives user credentials.