T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned Third-Party Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 14-20 **Vulnerability Type**: Unpinned execution of a third-party npm package **Risk Level**: Medium ### Vulnerable Code ```bash # Interactive installation (recommended) npx bmad-method install # Or install specific version npx bmad-method@6.0.1 install # Non-interactive / CI/CD npx bmad-method install --directory /path/to/project --modules bmm --tools claude-code --yes ``` ### Technical Analysis The documented commands instruct users to execute the external `bmad-method` npm package through `npx`. The interactive and CI/CD examples do not specify an exact package version, so the code retrieved and executed can change after this Skill has been reviewed. `npx` can download package content from the configured npm registry and execute its entry points under the privileges of the invoking user or CI runner. Consequently, compromise of the package publisher, registry distribution path, package dependencies, or a future package release could turn these commands into an arbitrary-code-execution vector. The `bmad-method@6.0.1` example limits version drift, but it still executes third-party code without documented integrity, provenance, or lifecycle-script verification. The non-interactive command increases exposure because it uses `--yes`, operates on a supplied project directory, and is intended for environments that may contain source-control or deployment credentials. No evidence establishes that the current package or version is malicious. The vulnerability is the unsafe trust and execution model documented by the Skill. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution chain, or one of the package's transitive dependencies. 2. The attacker publishes a malicious package version that is selected by the unpinned `npx bmad-method` invocation. 3. A developer or automated CI job follows the documented installation com ...[truncated 945 chars]
- Remediation
- ## Remediation Suggestions 1. Replace every unpinned invocation with an exact, reviewed package version, such as `npx bmad-method@6.0.1 install`. 2. Prefer installing the package through a committed dependency manifest and lockfile, followed by reproducible installation with `npm ci`. 3. Verify npm package provenance, publisher identity, signatures where available, and registry integrity metadata before execution. 4. Review package entry points, lifecycle scripts, and transitive dependencies before approving a version. 5. Use `--ignore-scripts` during dependency installation where lifecycle scripts are unnecessary, and explicitly execute only reviewed commands. 6. Run the installer in a sandbox or ephemeral CI worker with minimum filesystem and network permissions. 7. Do not expose unrelated source-control, deployment, cloud, or package-registry credentials to the installation process. 8. Configure automated dependency monitoring and require security review before updating the pinned version or lockfile.