T08 · Insecure Dependencies
Error
- Location
- SKILL.md:40
- Finding
- Unpinned Third-Party Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md:7, 38-44, 165`; mirrored in `SKILL-cn.md:7, 30-36, 144` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```bash # Install once npm install -g @dlazy/cli # Authenticate (device-code flow; works in remote shells) dlazy auth login ``` The metadata also specifies an unpinned execution alternative: ```text "install":"npm install -g @dlazy/cli", "installAlternative":"npx @dlazy/cli" ``` ### Technical Analysis The Skill instructs the agent to globally install or directly execute `@dlazy/cli` without pinning an exact reviewed version or verifying package integrity. The effective code retrieved from npm can therefore change after the Skill itself has been audited. Both `npm install -g` and `npx` may execute package lifecycle scripts and package-provided binaries. A malicious or compromised package release could consequently execute arbitrary code under the account running the command. Global installation also makes the package persist in the user's global npm environment beyond the immediate task. The audited project contains only documentation and does not include the package implementation, a lockfile, an integrity hash, or a vendored reviewed artifact. The behavior of the downloaded dependency therefore cannot be established from this repository alone. There is no evidence in the reviewed files that the current npm package is malicious; the vulnerability is the unsafe and mutable dependency acquisition mechanism. ### Attack Path 1. An attacker compromises the npm publisher account, publication pipeline, package dependency tree, or another component involved in distributing `@dlazy/cli`. 2. The attacker publishes a malicious release under the expected package name or causes the package's mutable distribution tag to resolve to a compromised version. 3. An agent follows the Skill and runs `npm install -g ...[truncated 1091 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to an exact reviewed version, such as `@dlazy/cli@2.0.6`, rather than relying on a mutable distribution tag. 2. Prefer a project-local installation governed by a committed lockfile instead of a global installation. 3. Verify the package artifact against a documented integrity hash, trusted provenance attestation, or signed release before execution. 4. Use an isolated, least-privileged environment for installation and execution. 5. Avoid `npx` without an exact version because it can retrieve and immediately execute a changed package. 6. Use `--ignore-scripts` where the package supports operation without lifecycle scripts. If lifecycle scripts are required, document and review them explicitly. 7. Add an upgrade process requiring review and integrity verification before changing the pinned version. 8. Keep the English and Chinese Skill documents synchronized so both provide the same dependency safeguards.