T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:284
- Finding
- Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:284`, `SKILL.md:393`, and `SKILL.md:689` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```markdown npm install next-themes ``` ```markdown The following components are available and all respect the theme tokens above. Install via `npx shadcn@latest add <component>`: ``` ```markdown 8. **Installing new components.** Use `npx shadcn@latest add <component>`. The CLI respects `components.json` and generates components with the correct theme tokens. ``` ### Technical Analysis The Skill instructs the agent to install `next-themes` without specifying an exact reviewed version and to execute `shadcn@latest` through `npx`. The `latest` tag is mutable and can resolve to a different package release each time the command is run. In addition, `npx` can download and immediately execute package CLI code. The package contains no lockfile, integrity checksum, provenance requirement, or allowlist identifying a previously reviewed release. Consequently, the effective code executed by the agent can change after this Skill has been audited. Likewise, `npm install next-themes` allows dependency resolution to select the current registry version and its transitive dependency graph. Package installation may invoke lifecycle scripts with the permissions of the process running the agent. This is a supply-chain weakness rather than evidence that the currently named packages are malicious. ### Attack Path 1. An agent loads the Skill and follows its component or dark-mode setup instructions. 2. The agent runs `npx shadcn@latest add <component>` or `npm install next-themes`. 3. The package manager resolves packages from the configured external registry. 4. If a package publisher account, registry entry, future release, or transitive dependency has been compromised, attacker-controlled package code is downloaded. 5. The package CLI or lifecycle script ex ...[truncated 1016 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace mutable package references with exact, reviewed versions: ```bash npm install --save-exact next-themes@<reviewed-version> npx --yes shadcn@<reviewed-version> add <component> ``` 2. Commit a lockfile and use deterministic installation commands such as `npm ci` where applicable. 3. Verify package integrity and provenance before execution, including registry origin, publisher identity, release signatures or attestations, and lockfile integrity hashes. 4. Require explicit user approval before executing package installation commands or third-party CLIs. 5. Avoid automatic use of the `latest` tag. Update pinned versions only after reviewing the new release and its dependency changes. 6. Run package-management commands in a sandbox or restricted environment with: - Access limited to the target project. - No unnecessary credentials or environment variables. - Restricted network access. - No administrative privileges. 7. Where feasible, disable lifecycle scripts during installation: ```bash npm install --ignore-scripts --save-exact next-themes@<reviewed-version> ``` If lifecycle scripts are required, review them before permitting execution. 8. Update the Skill's scope declaration. It currently claims to modify only CSS and Tailwind configuration, while its instructions also install dependencies and create or modify TSX component and layout files. The documented permissions and approval workflow should accurately reflect these operations. ]]>