T08 · Insecure Dependencies
Warning
- Location
- scripts/bin/opencode-server.js:13
- Finding
- Undisclosed Runtime Installation of Unpinned npm Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `scripts/bin/opencode-server.js:13-37`; `scripts/package.json:16-18` **Vulnerability Type**: Automatic installation of unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code `scripts/bin/opencode-server.js:13-37`: ```js async function checkAndInstallDependencies() { const scriptDir = path.join(__dirname, '..'); const packageJsonPath = path.join(scriptDir, 'package.json'); const nodeModulesPath = path.join(scriptDir, 'node_modules'); if (!fs.existsSync(packageJsonPath)) { console.error('Error: package.json not found in', scriptDir); process.exit(1); } if (!fs.existsSync(nodeModulesPath)) { console.log('📦 Dependencies not found. Installing...'); await installDependencies(scriptDir); console.log('✅ Dependencies installed successfully.'); } } function installDependencies(scriptDir) { return new Promise((resolve, reject) => { const npmInstall = exec('npm install', { cwd: scriptDir }); npmInstall.stdout.on('data', (data) => { process.stdout.write(data); }); npmInstall.stderr.on('data', (data) => { process.stderr.write(data); }); ``` `scripts/package.json:16-18`: ```json "dependencies": { "axios": "^1.6.0" } ``` ### Technical Analysis Every CLI invocation calls `checkAndInstallDependencies()`. If the `node_modules` directory is absent, the application automatically runs `npm install` at runtime. The project does not include a package lockfile, and the dependency uses the semver range `^1.6.0`. Consequently, the exact package and transitive dependency versions installed can vary over time. npm may also resolve packages through a user- or environment-configured registry and execute dependency lifecycle scripts during installation. The audit found no import or use of `axios` in the reviewed source code. The automatic installation therefore introduces avoidable supply-chain exposure without supporting ...[truncated 1939 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `axios` from `scripts/package.json` because the reviewed implementation does not use it. 2. Remove automatic dependency installation from the CLI. Dependency installation should be an explicit deployment or setup step rather than an undocumented side effect of every command. 3. If third-party dependencies are later required: - Pin exact versions rather than using permissive semver ranges. - Commit a reviewed `package-lock.json`. - Use `npm ci` to enforce the lockfile rather than `npm install`. - Run dependency installation in a controlled build or deployment phase. - Regularly audit dependencies and their transitive dependency trees. 4. Consider installing with lifecycle scripts disabled when package functionality does not require them, for example through an appropriately tested `--ignore-scripts` policy. 5. Document all installation behavior, network access, and required dependencies in `SKILL.md`. 6. Fail safely with clear setup instructions when dependencies are missing instead of downloading and executing packages automatically. ]]>