T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution of an Externally Published npm CLI Without Local Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5,57-65`; duplicated in `SKILL-cn.md:5,57-65` **Vulnerability Type**: Third-party dependency and software supply-chain risk **Risk Level**: Medium ### Vulnerable Code From `SKILL.md`: ```json "install":"npm install -g @dlazy/cli@1.2.3", "installAlternative":"npx @dlazy/cli@1.2.3" ``` ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` Equivalent instructions appear in `SKILL-cn.md`: ```json "install":"npm install -g @dlazy/cli@1.2.3", "installAlternative":"npx @dlazy/cli@1.2.3" ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ### Technical Analysis The Skill delegates its operational behavior to the externally published npm package `@dlazy/cli@1.2.3`. The dependency handles authentication, local API-key storage, supplied-file access, and communication with remote dLazy services, but its implementation is not included in the audited project. Pinning the dependency to version `1.2.3` limits unintended version drift, but the Skill does not specify or verify an expected package integrity digest, signature, or trusted build provenance. Both `npx` execution and global npm installation download and execute package-controlled code. npm lifecycle scripts may also run during installation unless explicitly disabled. This finding does not establish that the referenced package is currently malicious. The risk arises because the effective executable implementation is outside the reviewed artifact and depends on the security of the npm publication account, registry delivery path, package contents, and upstream build process. ### Attack Path 1. An attacker compromises the npm maintainer account, publication token, package build ...[truncated 1565 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the minimum required CLI implementation into a reviewable artifact, or independently audit the exact published package before approving its use. 2. Record and verify a cryptographic integrity digest for the approved npm package artifact rather than relying on the version number alone. 3. Require signed package provenance and verify that the package was produced by an approved repository and build workflow. 4. Prefer a locked local installation over repeated `npx` retrieval, and execute the exact reviewed artifact. 5. Disable npm lifecycle scripts during installation where they are not required, for example by using `npm install --ignore-scripts` after confirming compatibility. 6. Avoid global installation. Install the package into a dedicated, non-privileged environment with a lockfile and restricted permissions. 7. Run the CLI in a sandbox or container that only exposes the files needed for the requested generation task. 8. Restrict outbound network access to the documented endpoints, `api.dlazy.com` and `files.dlazy.com`, when operationally feasible. 9. Provide the API credential only for the duration of execution and ensure `~/.dlazy/config.json` is readable solely by its owner. 10. Add dependency monitoring, package-signature verification, and an incident process for revoking API keys if upstream compromise is suspected. ]]>