T08 · Insecure Dependencies
Warning
- Location
scripts/convert.js:872- Finding
Automatic npm Dependency Installation During Document Conversion
- Content
View full analysis
0) { console.log(chalk.cyan(`[INFO] Detected missing dependencies: ${missing.join(', ')}`)); console.log(chalk.cyan('[INFO] Installing dependencies...')); const { execSync } = await import('child_process'); try { execSync(`npm install ${missing.join(' ')}`, { stdio: 'inherit' }); console.log(chalk.green('[OK] Dependency installation completed')); } catch (e) { console.error(chalk.red(`[ERROR] Dependency installation failed: ${e.message}`)); process.exit(1); } } } ``` The installation function is invoked by default from the command-line action unless the user supplies `--no-auto-install`: ```javascript if (options.autoInstall !== false) { await ensureDependencies(); } ``` ### Technical Analysis The normal conversion workflow automatically invokes `npm install` when dependencies are considered missing. Package installation can execute package lifecycle scripts with the privileges of the user running the converter. This behavior expands a Markdown conversion operation into a software-installation and code-execution operation. The package names are defined internally, so no direct shell-command injection through the `missing` array was identified. However, the packages are installed without an explicit version in this command. The project also uses semver ranges in `package.json`, and dependency resolution relies on an external package registry or configured mirror. This ...[truncated 1190 chars]- Remediation
View remediation