T08 · Insecure Dependencies
- Location
SKILL.md:552- Finding
Unpinned Global npm Package Installation Creates Supply-Chain Risk
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 552 and 557
Vulnerability Type: Unpinned, globally installed third-party dependencies
Risk Level: MediumComplete Code Snippet:
bash npm install -g @wenyan-md/clibash npm install -g cheerioTechnical Analysis
The installation instructions resolve unspecified package versions from the npm registry and install them globally. Consequently, the installed code can differ from the version reviewed when this Skill was published.
npm packages can execute lifecycle scripts during installation. If a package release, transitive dependency, maintainer account, or registry resolution is compromised, following these commands could execute attacker-controlled code under the installing user's privileges. The
-goption increases exposure by installing packages into the user's or system's global npm environment. Installingcheerioglobally is also unnecessary for a package normally consumed as a library.The documentation references a legitimate upstream project for
@wenyan-md/cli; however, that reference does not pin or verify the artifact retrieved by npm. No malicious dependency is currently demonstrated, so this finding concerns unsafe dependency acquisition rather than a confirmed malicious package.Attack Path
- An attacker compromises an npm package, one of its transitive dependencies, its maintainer account, or the applicable registry resolution path.
- The attacker publishes a malicious release or adds a malicious installation lifecycle script.
- A user follows the Skill documentation and executes an unversioned
npm install -gcommand. - npm resolves the affected release because no reviewed exact version or lockfile constrains resolution.
- Malicious lifecycle code executes with the privileges of the user running npm.
- The payload may access that user's files and credentials or modify globally installed toolin ...[truncated 653 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin every dependency to an exact, reviewed version rather than resolving the latest release.
- Install dependencies locally in a dedicated project directory instead of using
-g. - Commit a lockfile and use
npm cito obtain reproducible dependency trees. - Verify registry provenance and package integrity before installation.
- Audit both direct and transitive dependencies and regularly review lockfile changes.
- Disable lifecycle scripts with
--ignore-scriptswhere package functionality permits; otherwise, review required scripts before installation. - Treat
cheerioas a local application dependency rather than a global command-line package. - Run installation as an unprivileged user in an isolated environment and avoid
sudo npm install -g.