T08 · Insecure Dependencies
- Location
agents/boss-qa.md:425- Finding
Unpinned Third-Party Package Retrieval and Execution
- Content
View full analysis
Vulnerability Details
File Location:
agents/boss-qa.md:425agents/boss-qa.md:459-463agents/boss-qa.md:479-490agents/boss-qa.md:553-558agents/boss-devops.md:45
Vulnerability Type: Supply-chain exposure through unpinned npm dependencies and runtime package execution
Risk Level: MediumVulnerable Code
From
agents/boss-qa.md:bash pnpm test --coverage 2>&1 || npm test --coverage 2>&1 || npx vitest run --coverage 2>&1bash # Frontend Playwright npx playwright test 2>&1 # Frontend Cypress npx cypress run 2>&1 # Backend API tests pnpm test:e2e 2>&1 || npm run test:e2e 2>&1bash # Install Playwright npm install -D @playwright/test npx playwright install # Or install Cypress npm install -D cypress # Install agent-browser (optional) npm install -g agent-browser agent-browser installbash # Check browserslist configuration npx browserslist # Run multi-browser tests npx playwright test --project=chromium --project=firefox --project=webkit 2>&1From
agents/boss-devops.md:text | Static HTML | npx serve | 3000 |Technical Analysis
The QA and deployment instructions direct the Agent to install or execute npm packages without exact version constraints, integrity verification, or a requirement that packages already exist in the project's lockfile.
When a referenced package is unavailable locally,
npxmay download and immediately execute it from the configured npm registry. Commands such asnpm install -D @playwright/test,npm install -D cypress, andnpm install -g agent-browsersimilarly resolve mutable package versions and execute package lifecycle scripts. The globalagent-browserinstallation additionally modifies the user's shared environment rather than remaining isolated to the audited project.These operations are releva ...[truncated 2116 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin every testing and browser automation dependency to an reviewed exact version.
- Commit and enforce a package lockfile, then install dependencies with
npm cior an equivalent frozen-lockfile command. - Replace runtime downloads with project-local execution:
- Use package scripts backed by committed dependencies.
- Use
npx --no-installwhere appropriate. - Fail safely when the required local binary is unavailable.
- Remove
npm install -g agent-browser. Install a pinned version as a local development dependency or run it in an isolated, pinned container. - Require explicit user approval before:
- Adding or updating dependencies.
- Downloading browser binaries.
- Installing global tooling.
- Running package lifecycle scripts.
- Disable lifecycle scripts during initial installation when feasible, review the package contents, and enable only the scripts that are required.
- Use an approved registry, package allowlist, integrity verification, and available npm provenance controls.
- Prefer existing project test runners rather than falling back automatically to remotely resolved
npxpackages. - Replace
npx servewith a pinned project-local server dependency or a trusted runtime component already present in the environment. - Run downloaded development tools in a sandbox with restricted filesystem and network access.