T08 · Insecure Dependencies
- Location
scripts/setup-keyco.sh:34- Finding
Unpinned Global npm Package Installation with Root-Level Fallback
- Content
View full analysis
Vulnerability Details
File Location:
scripts/setup-keyco.sh, lines 34–45
Vulnerability Type: Unpinned third-party dependency installation with privilege escalation
Risk Level: MediumVulnerable Code
bash if command -v keyco >/dev/null 2>&1; then CURRENT_VERSION="$(keyco --version 2>/dev/null || echo unknown)" info "Keyco CLI already installed (${CURRENT_VERSION})" else info "Installing @keyco/cli globally via npm..." if ! npm install -g @keyco/cli; then warn "Global install failed. Retrying with sudo (you may be prompted for your password)..." sudo npm install -g @keyco/cli fi info "Installed: $(keyco --version 2>/dev/null || echo @keyco/cli)" fiThe automatic execution of this setup path is also documented in
SKILL.md, lines 27–37:markdown 1. Check if `keyco` is on PATH: `which keyco` 2. Check configuration: `keyco status` 3. **If either check fails, run the setup script** — it handles install + configure in one shot: ```bash bash scripts/setup-keyco.shThe script will:
- Install
@keyco/cliglobally via npm if missing (falling back tosudo npmif needed)
text ### Technical Analysis The setup script installs `@keyco/cli` without specifying an exact version, lockfile, expected integrity digest, package provenance requirement, or explicit trusted registry. Consequently, npm resolves whichever version and source are selected by the active npm configuration at execution time. npm installations may execute package lifecycle scripts. If the ordinary global installation fails, the script retries the installation through `sudo`, potentially executing package-controlled code with root privileges. A compromised package release, registry account, transitive dependency, or redirected npm registry could therefore turn the setup operation into arbitrary privileged code execution. The issue is classified primarily as an insecure dependency because the initial trust failure arises from dynamica ...[truncated 1480 chars]- Install
- Remediation
View remediation
Remediation Suggestions
-
Pin
@keyco/clito a reviewed exact version rather than installing the latest registry-selected release:bash npm install -g --ignore-scripts @keyco/cli@X.Y.Z -
Verify the package against an expected integrity digest or trusted signed provenance before installation. Establish a controlled update process for changing the approved version and digest.
-
Enforce the intended npm registry instead of inheriting an arbitrary user or environment configuration. Validate the effective registry before downloading any package.
-
Remove the automatic
sudo npm install -gfallback. Prefer one of the following:- A project-local, pinned dependency.
- A user-scoped npm prefix.
- A vetted standalone binary installed into a user-owned directory.
- A managed system package installed by an administrator through an approved deployment process.
-
Avoid package lifecycle scripts where the CLI does not require them by using
--ignore-scripts. If lifecycle scripts are required, review them and their transitive dependencies before approving installation. -
Require explicit informed user confirmation before downloading or installing external software. Clearly display the exact version, registry, destination, and requested privilege level.
-
After installation, verify that the resolved executable belongs to the expected package and matches the approved version and checksum before invoking it.
-