T08 · Insecure Dependencies
Warning
- Location
scripts/quick-test.sh:19- Finding
Automatic Installation and Execution of an Unpinned Global npm Package
- Content
View full analysis
/dev/null 2>&1; then npm i -g @hackerpl/bailian-cli fi ``` From `SKILL.md:14-24`: ```bash npm ls -g --depth=0 @hackerpl/bailian-cli ``` ```bash npm i -g @hackerpl/bailian-cli ``` ### Technical Analysis The smoke-test script automatically installs `@hackerpl/bailian-cli` from the npm registry when the package is not already available. No exact version, package integrity hash, lockfile, provenance requirement, or reviewed artifact is specified. As a result, the code installed and subsequently executed can change without any modification to this project. npm installation may execute package lifecycle scripts, and the installed `bailian` command later runs with the invoking user's permissions and environment. Global installation also places the package outside an isolated project dependency tree, increasing its reach and making reproducible review more difficult. The project does not contain evidence that the named package is currently malicious. The risk arises from trusting an unpinned external package and automatically installing it before execution. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution process, or a future package release. 2. The attacker publishes a modified version of `@hackerpl/bailian-cli` containing a malicious lifecycle script or CLI payload. 3. A user runs `scripts/quick-test.sh` on a system where the package is not globally installed. 4. The script executes `npm i -g @hackerpl/bailian-cli` and retrieves the current uncontrolled package version. 5. Malicious lifecycle code may execute during installation, or malicious code executes when the script ...[truncated 893 chars]- Remediation
View remediation