T08 · Insecure Dependencies
Warning
- Location
SKILL.md:49- Finding
Unpinned Supabase CLI Execution Through npx
- Content
View full analysis
` for production. 5. Regenerate types: `npx supabase gen types typescript --local > src/lib/supabase/types.ts`. 6. Commit the migration and types: `git add supabase/ src/lib/supabase/types.ts && git commit -m "db: "`. ``` Additional affected commands from `SKILL.md:109`, `SKILL.md:112-113`, and `SKILL.md:139`: ```bash npx supabase functions new npx supabase functions serve npx supabase functions deploy npx supabase db reset ``` ### Technical Analysis An unqualified invocation such as `npx supabase` does not establish which exact package version must execute. If an appropriate local binary is unavailable, `npx` can retrieve a package from the configured npm registry. The effective executable can therefore change after the skill has been reviewed. The project contains no package manifest or lockfile pinning a specific Supabase CLI release. The documented commands also do not use `--no-install` or another mechanism that prevents on-demand package retrieval. Consequently, execution depends on mutable external package and registry state. This creates a supply-chain exposure because npm package installation and startup logic can execute with the privileges of the agent process. In this skill's intended environment, that process has filesystem and network permissions and may have Supabase credentials availabl ...[truncated 1912 chars]- Remediation
View remediation
``` 2. Commit the package manifest and lockfile, and require immutable installation in automation: ```bash npm ci ``` 3. Prevent `npx` from downloading a missing package at execution time: ```bash npx --no-install supabase db push npx --no-install supabase gen types typescript --local npx --no-install supabase functions deploy ``` Invoking the verified local binary directly is another acceptable option: ```bash ./node_modules/.bin/supabase db push ``` 4. Verify lockfile integrity and dependency provenance in trusted CI. Use registry allowlisting, dependency review, and package-signature or provenance checks where supported. 5. Run dependency installation separately from credential-bearing database operations. Do not expose `SUPABASE_SERVICE_ROLE_KEY` during package installation. 6. Provide the service-role credential only to operations that strictly require it, use a dedicated least-privilege environment, and avoid inheriting unrelated secrets into CLI subprocesses. 7. Pin remote dependencies used by generated Edge Functions to reviewed immutable versions where practical, and periodically review pinned updates before adoption. ]]>