T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:39
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed via npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:39-43`; duplicated in `README.md:25-29` **Vulnerability Type**: Unpinned remote package execution and supply-chain risk **Risk Level**: Medium ### Complete Code Snippets `SKILL.md:39-43`: ```markdown ## Installation ```bash npx @gztanht/cryptowatch ``` ``` `README.md:25-29`: ```markdown ## 🚀 Quick Start ```bash # Install npx @gztanht/cryptowatch ``` The local manifest identifies the reviewed project differently at `package.json:1-4`: ```json { "name": "cryptowatch", "version": "1.0.2", "description": "₿ CryptoWatch - 加密货币价格监控，24h 涨跌幅排行榜", ``` ### Technical Analysis The documented `npx @gztanht/cryptowatch` command can retrieve the current package release from the npm registry and execute its package entry point with the invoking user's privileges. The command does not pin an exact version or provide an integrity value, so the code executed by a future installation can differ from the source reviewed in this audit. In addition, the reviewed manifest names the local package `cryptowatch`, whereas the command executes `@gztanht/cryptowatch`. The repository contents therefore do not establish that the registry artifact invoked by the documentation is identical to the audited code. This is a supply-chain execution boundary rather than evidence that the current repository contains a malicious payload. Exploitation requires the referenced npm package, its publisher account, or its publication process to become malicious or compromised. ### Attack Path 1. An attacker compromises the npm publisher account, publication token, build pipeline, or another component controlling `@gztanht/cryptowatch`. 2. The attacker publishes a malicious version and makes it the version selected by the unpinned `npx` command. 3. A user follows the installation instructions and runs `npx @gztanht/cryptowatch`. 4. npm downloads the remotely ...[truncated 924 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the documented command to an exact, reviewed package version, for example: ```bash npx --yes @gztanht/cryptowatch@1.0.2 ``` 2. Ensure that the npm package identity matches the identity declared by the reviewed source, or clearly document and verify why the registry package uses a different scoped name. 3. Publish npm provenance attestations and retain a reproducible mapping between source commits, release tags, and registry artifacts. 4. Use a lockfile with exact dependency resolution for development and packaged releases. 5. Document a safer installation workflow that separates downloading or installing the package from executing it, allowing users to inspect the resolved package first. 6. Protect npm publication credentials with multi-factor authentication, short-lived automation tokens, restricted token permissions, and a controlled release pipeline. 7. Update both `SKILL.md` and `README.md` so that all installation examples use the same pinned and verifiable release. ]]>