T08 · Insecure Dependencies
- Location
SKILL.md:390- Finding
Execution of an Unpinned npm Package Through a Mutable Release Tag
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 51 and 390-407
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: MediumVulnerable Code
At line 51:
bash npx molthub@latest search "your-slug"Publishing commands at lines 390-407:
bash # Publish a new skill npx molthub@latest publish ./skills/my-skill \ --slug my-skill \ --name "My Skill" \ --version 1.0.0 \ --changelog "Initial release" # Update an existing skill npx molthub@latest publish ./skills/my-skill \ --slug my-skill \ --name "My Skill" \ --version 1.1.0 \ --changelog "Added new section on X" # Verify it's published npx molthub@latest search "my-skill"Technical Analysis
The skill directs an agent to invoke
molthub@latestthroughnpx. When the package is not already installed,npxcan retrieve it from the configured npm registry and immediately execute its code. Thelatesttag is mutable and does not identify a fixed, previously reviewed package version.This means the code executed by the documented commands can change after the skill has been reviewed. A compromised package release, maintainer account, registry, or package distribution process could cause arbitrary package code to run when an agent follows these otherwise legitimate instructions.
The repository contains no evidence that the referenced package is currently malicious. The confirmed issue is the unsafe dependency execution pattern and the absence of version pinning, integrity validation, provenance checks, or isolation requirements.
Attack Path
- An attacker compromises the package maintainer account, publishing process, registry entry, or another mechanism controlling the
molthubpackage. - The attacker publishes a malicious version and assigns it to the mutable
latesttag. - A user or agent follows the skill's slug-checking, publishing, updating, or verification instructions.
npxresolvesmolthub@latestand downlo ...[truncated 1009 chars]
- An attacker compromises the package maintainer account, publishing process, registry entry, or another mechanism controlling the
- Remediation
View remediation
Remediation Suggestions
- Replace the mutable
latesttag with an exact, reviewed version:
bash npx --yes molthub@<reviewed-exact-version> search "your-slug" npx --yes molthub@<reviewed-exact-version> publish ./skills/my-skill \ --slug my-skill \ --name "My Skill" \ --version 1.0.0 \ --changelog "Initial release"-
Record the selected version in a lockfile and verify its package integrity before use. Update the pin only after reviewing the new release and its dependency changes.
-
Document the expected npm registry, official package name, and trusted publisher identity to reduce dependency-confusion and registry-substitution risks.
-
Prefer a preinstalled and organization-approved CLI in controlled environments rather than allowing
npxto download executable code during each invocation. -
Run publishing operations in an isolated environment with least-privilege credentials. Use a narrowly scoped token that can access only the intended registry namespace and revoke it after suspected compromise.
-
Disable unnecessary package lifecycle scripts where compatible with the trusted CLI, and monitor package provenance or signatures when the package ecosystem supports them.
-
Apply the same pinned version consistently to search, publish, update, and verification commands so that validation and publication do not execute different package releases.
- Replace the mutable