T08 · Insecure Dependencies
Warning
- Location
SKILL.md:49- Finding
Unpinned Executable Dependencies Create a Mutable Software Supply Chain
- Content
View full analysis
--typescript --tailwind --eslint --app --src-dir --import-alias "@/*"` to create the Next.js project with App Router. 2. `cd` into the project directory. 3. Ensure `.gitignore` exists and includes at minimum: `.env`, `.env.local`, `.env*.local`, `node_modules/`, `.next/`. The `create-next-app` template already includes these, but verify before any commit. 4. Initialize git: `git init && git add -A && git commit -m "chore: initial Next.js scaffold"`. ## Dependencies Install the following in a single command: ```bash npm install @supabase/supabase-js @supabase/ssr firebase firebase-admin zod zustand next-themes npm install -D @types/node vitest @vitejs/plugin-react playwright @playwright/test prettier eslint-config-prettier ``` ``` The generated package script also invokes an unpinned CLI: ```json { "types:supabase": "npx supabase gen types typescript --local > src/lib/supabase/types.ts" } ``` ### Technical Analysis The skill directs the agent to execute `create-next-app@latest`, install multiple packages without explicit versions, and later execute `npx supabase` without pinning or explicitly installing a reviewed CLI release. These commands resolve executable content dynamically from the npm registry. As a result, the code executed during one invocation may differ from the code reviewed during the audit. Package installation can also run lifecycle scripts with the privileges and environment of the invoking process. The listed package names are consistent with the skill's declared scaffolding purpose, and there is no evidence that any package is currently malicious. The vulnerability is the mutable, unreviewed dependency resolution process rather than a confirmed malicio ...[truncated 1425 chars]- Remediation
View remediation
... ``` 2. Pin all direct dependencies and development dependencies to exact reviewed versions rather than relying on current registry resolution. 3. Generate and commit `package-lock.json`, then use `npm ci` for reproducible installation. 4. Explicitly install a pinned Supabase CLI version and invoke the local binary instead of allowing `npx supabase` to resolve an arbitrary current version. 5. Review transitive dependency changes before updating the lockfile. 6. Use automated dependency scanning, provenance verification, and package integrity checks. 7. Disable lifecycle scripts with `--ignore-scripts` where compatible, or explicitly review packages that require installation scripts. 8. Run dependency installation in a restricted environment with sanitized credentials, minimum filesystem access, and constrained network access. ]]>