T08 · Insecure Dependencies
Warning
- Location
- package-lock.json:382
- Finding
- Nodemailer Dependency Retrieved from a Non-Official Package Registry<![CDATA[ ## Vulnerability Details **File Location**: `package-lock.json:382-387`; dependency installation is triggered by `setup.sh:17-20` **Vulnerability Type**: Third-party dependency supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```bash # Install Node.js dependencies SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" if [ ! -d "$SKILL_DIR/node_modules" ]; then echo "Installing dependencies..." (cd "$SKILL_DIR" && npm install --production) echo "" fi ``` ```json "node_modules/nodemailer": { "version": "9.0.3", "resolved": "https://registry.npmmirror.com/nodemailer/-/nodemailer-9.0.3.tgz", "integrity": "sha512-n+YP+NKwR5zRWa60k3GiQ6Q3B4KXCoAw40dAKeCtYn020iNN74aWK2liXIC3ZEATeGql7we3tE3t8QwhY0eskw==", "license": "MIT-0", "engines": { "node": ">=6.0.0" } } ``` ### Technical Analysis The setup process automatically invokes `npm install --production`. The lockfile instructs npm to retrieve the primary Nodemailer package from `registry.npmmirror.com`, while the other dependencies are predominantly retrieved from the official npm registry. Nodemailer is a security-sensitive dependency because it receives SMTP credentials, message contents, recipient addresses, and local attachment paths. Using an additional package-distribution operator expands the supply-chain trust boundary beyond the official npm registry. The pinned SHA-512 integrity value materially limits exploitation: control of the mirror alone is not sufficient to replace the package transparently because npm should reject content that does not match the lockfile hash. Successful package substitution would therefore also require modification of the lockfile integrity value, compromise or bypass of npm integrity verification, or delivery of a package already matching the trusted digest. The non-official source nevertheless creates an avoidable dependency-delivery and availability risk. ### Attack Path 1. A user runs `bash setup.sh`. 2. If `node_modules` is absent, the ...[truncated 1215 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Regenerate the lockfile so all packages are resolved from the official npm registry: ```bash npm config set registry https://registry.npmjs.org/ rm -rf node_modules package-lock.json npm install --package-lock-only ``` 2. Review the resulting lockfile and confirm that no unexpected registry domains remain. 3. Replace `npm install --production` with deterministic installation: ```bash npm ci --omit=dev ``` 4. If dependency lifecycle scripts are not required, further reduce installation-time execution exposure: ```bash npm ci --omit=dev --ignore-scripts ``` 5. Preserve and verify lockfile integrity values in source control. 6. Add CI checks that reject lockfile `resolved` URLs outside an approved registry allowlist. 7. Periodically audit the dependency tree, especially packages that process credentials, email content, or attachments. ]]>