T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:7
- Finding
- Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md:7-9`; `README.md:8-12` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code `SKILL.md:7-9`: ```yaml requires: binaries: [accli] install: "npm install -g @gopaljigaur/accli" ``` `README.md:8-12`: ```markdown ## Install ```bash npm i -g @gopaljigaur/accli ``` ``` ### Technical Analysis The installation instructions resolve and globally install the latest available release of `@gopaljigaur/accli` without pinning an exact version or verifying an integrity digest. Consequently, the code executed by users may differ from the version that existed when this Skill was reviewed. npm packages can include package-controlled lifecycle scripts that execute during installation. The global installation also makes the resulting executable broadly available in the user's environment. The project contains only documentation and does not include the dependency's implementation, a lockfile, a package integrity value, or vendored source through which its behavior could be independently verified. This risk is amplified by the documented instruction to run `accli setup` and grant the installed program Full Access to macOS Calendar data. Calendar access is consistent with the Skill's declared purpose, but the identity and behavior of the code receiving that permission are not reproducibly fixed by the installation instructions. No evidence establishes that the current package is malicious. The finding concerns the unsafe, mutable dependency acquisition mechanism and the resulting supply-chain exposure. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution process, or a future release of `@gopaljigaur/accli`. 2. The attacker publishes a modified version containing malicious runtime behavior or an npm lifecycle script. 3. A user follows the documented unpinned command, causing npm to resol ...[truncated 1108 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version: ```bash npm install -g @gopaljigaur/accli@<exact-reviewed-version> ``` 2. Record and verify the package integrity digest and provenance before installation. 3. Include or link to immutable source corresponding exactly to the pinned package release so its behavior can be audited. 4. Prefer a project-local installation backed by a committed lockfile instead of a global installation where operationally possible. 5. Review npm lifecycle scripts and use `--ignore-scripts` when the package does not legitimately require them. 6. Document the expected package publisher, repository, version, and checksums so users can detect substitution. 7. Apply least privilege to Calendar authorization and clearly disclose that Full Calendar access permits reading, changing, and deleting sensitive events. 8. Re-audit the dependency before updating the pinned version.