T08 · Insecure Dependencies
- Location
package.json:6- Finding
Unpinned Dependencies Executed Through npx
- Content
View full analysis
Vulnerability Details
File Location:
package.json:6-12; related instructions inSKILL.md:55-58andREADME.md:90-93
Vulnerability Type: Supply-chain exposure through mutable dependency resolution andnpxexecution
Risk Level: MediumVulnerable Code
json "scripts": { "list": "npx tsx src/cli.ts list", "start": "npx tsx src/cli.ts start", "finish": "npx tsx src/cli.ts finish", "count-last-year": "npx tsx src/cli.ts count-last-year", "test": "vitest run --exclude 'src/**/*.integration.test.ts'", "test:integration": "vitest run src/client.integration.test.ts" }, "devDependencies": { "tsx": "^4", "vitest": "^3" }The documented commands also directly use
npx:bash npx tsx src/cli.ts list [--limit 20] [--json] npx tsx src/cli.ts start --title "The Complete Maus" [--json] npx tsx src/cli.ts finish --title "The Complete Maus" [--json] npx tsx src/cli.ts count-last-year [--json]Technical Analysis
The Skill executes the third-party
tsxpackage throughnpx, while its dependencies use non-exact version ranges and the project contains no reviewed lockfile. Consequently, installation is not reproducible:npm installmay resolve a newer package version than the version reviewed during this audit.If the local
tsxexecutable is unavailable,npxmay retrieve and execute a package from the configured npm registry. The effective executable can therefore depend on registry state, package publication changes, local npm configuration, or a compromised package release.This is particularly sensitive because the commands run in a process that can access
HARDCOVER_TOKEN. Although the audited source sends that credential only to the fixed Hardcover HTTPS endpoint, third-party code executed before or alongside the client has the same process-level ability to read environment variables.No evidence was found that the current declared dependencies are malicious. The vulnerability is the absence of reproduci ...[truncated 1408 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin all dependencies to reviewed exact versions rather than permissive ranges:
json "devDependencies": { "tsx": "4.x.y", "vitest": "3.x.y" }- Generate and commit
package-lock.json, and require deterministic installation with:
bash npm ci- Avoid allowing
npxto download packages during normal Skill execution. Invoke the verified local binary through an offline-enforced command, for example:
bash npm exec --offline -- tsx src/cli.ts listAlternatively, expose fixed npm scripts that invoke the locally installed binary and ensure installation is completed before credentials are supplied.
-
Configure CI to reject dependency or lockfile drift and review dependency updates before release.
-
Run dependency integrity and vulnerability checks during release preparation, including:
bash npm audit npm ci-
Where practical, run the Skill with a minimal environment containing only
HARDCOVER_TOKENand restrict filesystem and network access to reduce the impact of a compromised dependency. -
Document that commands must not fall back to runtime registry retrieval and that only lockfile-verified installations are supported.