T08 · Insecure Dependencies
Error
- Location
cli.js:201- Finding
Unpinned Remote Packages and Dependencies Are Retrieved and Executed
- Content
View full analysis
Vulnerability Details
File Location:
cli.js:201-212,cli.js:371,cli.js:436-450,packages.json:8-9,SKILL.md:18,README.md:9
Vulnerability Type: Untrusted dependency retrieval and execution without version or integrity pinning
Risk Level: HighVulnerable Code
cli.js:201-212:javascript // Install via npm runCmd(`npm install -g ${pkg.npm}`, { stdio: 'pipe' }); // Run setup if available if (pkg.npm === 'jasper-recall') { console.log(' Running setup...'); runCmd('npx jasper-recall setup', { stdio: 'inherit' }); } else if (pkg.npm === 'hopeid') { console.log(' Running setup...'); runCmd('npx hopeid setup', { stdio: 'inherit' }); } else if (pkg.npm === 'jasper-context-compactor') { console.log(' Running setup...'); runCmd('npx jasper-context-compactor setup', { stdio: 'inherit' }); }cli.js:371:javascript runCmd(`npm install -g ${pkg.npm}@latest`, { stdio: 'pipe' });cli.js:436-450:javascript runCmd(`git clone https://github.com/E-x-O-Entertainment-Studios-Inc/${repo}.git ${targetDir}`, { stdio: 'inherit' }); success(`Cloned ${name}`); // Install dependencies if package.json exists const pkgJson = path.join(targetDir, 'package.json'); if (fs.existsSync(pkgJson)) { console.log(` Installing ${name} dependencies...`); try { runCmd(`cd ${targetDir} && npm install`, { stdio: 'pipe' }); success(`${name} dependencies installed`); } catch (e) { warn(`${name} npm install had issues`); } }packages.json:8-9:json "doctorCmd": "npx jasper-recall doctor --json", "versionCmd": "npx jasper-recall --version"The documented installation paths are likewise unpinned:
bash npx exo-installer install --all npm install -g exo-installerTechnical Analysis
The installer retrieves npm packages by mutable package name or the explicit mutable
latesttag. It does not pin audited versions, validate expected integrity hashes, enforce provenance, or restrict ...[truncated 2831 chars]- Remediation
View remediation
Remediation Suggestions
- Pin every package to a reviewed, exact version rather than using bare package names or
@latest. - Maintain lockfiles for cloned applications and use
npm ciinstead ofnpm installso dependency resolution cannot silently drift. - Pin internal repositories to reviewed commit hashes or signed release tags and verify the checked-out commit before installing dependencies.
- Verify npm package integrity and provenance against expected values before execution. Where supported, require signed provenance from trusted publishers.
- Disable lifecycle scripts by default with
--ignore-scripts, then explicitly invoke only reviewed setup steps when they are genuinely required. - Replace
npxhealth and version checks with direct invocation of already-installed binaries resolved from trusted paths. Checks must fail closed if the executable is absent rather than downloading it. - Avoid global installation where possible. Install into a dedicated, least-privileged directory or isolated environment.
- Separate update discovery from update execution and require explicit confirmation showing the exact version and verified source.
- Run package setup and dependency installation in a sandbox with restricted filesystem, network, credential, and environment-variable access.
- Continuously audit both direct and transitive dependencies and review package ownership changes before accepting updates.
- Pin every package to a reviewed, exact version rather than using bare package names or