T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution of an Unverified Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5, 54-61`; equivalent instructions appear in `SKILL-cn.md:5, 54-61` **Vulnerability Type**: Third-party supply-chain exposure through automatic package installation and execution **Risk Level**: Medium ### Vulnerable Code ```json "install": "npm install -g @dlazy/cli@1.2.3", "installAlternative": "npx @dlazy/cli@1.2.3" ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` The Chinese-language document contains the same executable package instructions: ```json "install": "npm install -g @dlazy/cli@1.2.3", "installAlternative": "npx @dlazy/cli@1.2.3" ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ### Technical Analysis The Skill directs the Agent to download and execute the external npm package `@dlazy/cli@1.2.3`, either through a global installation or through `npx`. Version pinning reduces unintended version drift, but it does not independently establish package integrity or prove that the published artifact matches reviewed source code. The audited project contains only documentation and metadata. It does not include the CLI implementation, an integrity digest, a cryptographic signature, or a vendored and reviewable copy of the dependency. Consequently, the effective executable behavior cannot be verified from this artifact. This is a supply-chain trust-boundary issue rather than evidence that the named package is currently malicious. Exploitation would require compromise or substitution of the external package, its maintainer account, or the package distribution path. ### Attack Path 1. A user or Agent invokes the Skill. 2. The Skill causes `npm install -g @dlazy/cli@1.2.3` or `npx @dlazy/cli@1.2.3` to retrieve the package from the npm ecosystem. 3. If the pinned package artifact or its distribution channel has been compromised, npm installs or executes attacker-controlled content. 4. Package lifecycle scripts or the CLI entry point execute with the privileges of the invoking user. 5. The m ...[truncated 1130 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor a reviewed copy of the required CLI implementation with the Skill, or otherwise make the exact executable source available for audit. 2. Publish cryptographically signed release artifacts and verify the signature before installation or execution. 3. Record and verify an immutable integrity digest for the exact npm package tarball. 4. Run `npm` with lifecycle scripts disabled where they are not required, for example by applying an appropriate `--ignore-scripts` policy after confirming that the CLI remains functional. 5. Prefer execution in a sandbox or container with access limited to explicitly selected input files and required network endpoints. 6. Avoid running the installation as `root`, through `sudo`, or from another privileged account. 7. Restrict the CLI process from accessing unrelated credentials, files, environment variables, and directories. 8. Independently compare the published npm artifact with the referenced GitHub source and review the dependency tree before approving installation. 9. Continue pinning the dependency version, but combine version pinning with integrity verification and a controlled update process. ]]>