T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:10
- Finding
- Execution of an Unreviewed Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:10, 51-57`; identical content in `SKILL-cn.md:10, 51-57` **Vulnerability Type**: Third-party dependency and supply-chain risk **Risk Level**: Medium ### Vulnerable Code Snippet ```json "requires": { "bins": ["npm", "npx"] }, "install": "npm install -g @dlazy/cli@1.2.3", "installAlternative": "npx @dlazy/cli@1.2.3" ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` The Skill also recommends global installation through: ```bash npm install -g @dlazy/cli@1.2.3 ``` ### Technical Analysis The Skill requires downloading and executing the external `@dlazy/cli` npm package. Neither the package implementation nor its transitive dependencies are included in the audited project, so their behavior cannot be verified from the two reviewed files. Pinning the package to version `1.2.3` reduces version drift, but it does not provide cryptographic integrity verification, a reviewed lockfile, or protection against compromise of the npm account, published artifact, or transitive dependency graph. npm package installation may also execute lifecycle scripts with the permissions of the invoking user. Global installation increases exposure by placing the package in a shared executable location and making it available beyond the lifetime of the current Skill operation. The documentation contains an additional version-integrity inconsistency: it states that the install field is pinned to `1.0.9`, while the actual metadata and commands use `1.2.3`. This ambiguity can interfere with reproducible review and deployment. ### Attack Path 1. The user or Agent invokes the Skill. 2. The Skill directs the environment to run `npm install -g @dlazy/cli@1.2.3` or `npx @dlazy/cli@1.2.3`. 3. npm retrieves the package and its transitive dependencies from an external registry. 4. Package lifecycle scripts or CLI initialization code execute with the invoking user's privileges. 5. If the published package or any dependency is compr ...[truncated 1022 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor or otherwise include the exact CLI source and dependency lockfile in the review scope. 2. Verify the npm artifact with a trusted cryptographic digest before execution. 3. Lock all transitive dependencies and perform automated dependency, provenance, and malware scanning. 4. Prefer a reviewed local binary or package installation over `npx`, which retrieves executable content at invocation time. 5. Avoid global installation. Install into an isolated project directory or disposable container. 6. Disable npm lifecycle scripts where operationally possible, such as by using `--ignore-scripts`, after confirming that the package does not legitimately require them. 7. Run the CLI in a sandbox with restricted filesystem access, a minimal environment, and network access limited to documented endpoints. 8. Correct the `1.0.9` versus `1.2.3` documentation inconsistency and define one reviewed version as the authoritative dependency. 9. Document package publisher verification, expected checksums, dependency-review procedures, and incident-response steps for package compromise. ]]>