T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:15
- Finding
- Unpinned Third-Party Package Installed Globally<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15-19 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installation ```bash npm install -g @supernalintelligence/supernal-coding ``` ``` ### Technical Analysis The installation instructions direct users to install `@supernalintelligence/supernal-coding` globally without specifying a reviewed version or verifying package integrity. Consequently, npm resolves the package version from the registry at installation time, and the installed code may differ from the version that existed when this Skill was audited. npm packages can define lifecycle scripts that execute during installation. A globally installed package can also place executable commands in the user's global npm binary directory. If the package, its maintainer account, its publishing credentials, or the upstream registry is compromised, users following these instructions could execute attacker-controlled code without any corresponding modification to `SKILL.md`. The audit found no evidence that the referenced package is currently malicious. The confirmed issue is the unsafe, unpinned global installation pattern and its resulting supply-chain exposure. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, publishing credentials, or another component of the package's dependency chain. 2. The attacker publishes a malicious release under the existing package name. 3. A user follows the documented `npm install -g` command. 4. npm resolves the latest available release because no version is pinned. 5. Malicious lifecycle scripts can execute during installation with the privileges of the user running npm. 6. The package can install or replace the globally accessible `sc` executable. 7. Subsequent legitimate-looking `sc` invocations can run attacker-controlled logic. ### Impact Assessment Successful exploitation could provide code execution wit ...[truncated 563 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version, for example: ```bash npm install -g @supernalintelligence/supernal-coding@<reviewed-version> ``` 2. Publish and verify the expected package integrity hash or npm provenance before installation. 3. Link to the package's canonical registry and source repository so users can verify its identity and avoid similarly named packages. 4. Prefer a project-local installation with a committed lockfile over a global installation where operationally possible. 5. Use `npm ci` in automated environments to enforce lockfile-resolved versions and integrity metadata. 6. Review package lifecycle scripts before installation. Where compatible with the package, install with lifecycle scripts disabled: ```bash npm install --ignore-scripts ``` 7. Periodically review and explicitly approve upgrades rather than implicitly installing the latest registry release. ]]>