T08 · Insecure Dependencies
Warning
- Location
- setup.md:22
- Finding
- Unpinned Cypress Dependency Is Installed and Immediately Executed<![CDATA[ ## Vulnerability Details **File Location**: `setup.md:22-23` **Vulnerability Type**: Supply-chain exposure through unpinned package installation **Risk Level**: Medium ### Vulnerable Code ```bash npm install -D cypress npx cypress open # First run creates folder structure ``` ### Technical Analysis The setup instructions install Cypress without specifying an audited version and then immediately execute its binary through `npx`. Resolution therefore depends on the package version available from the configured npm registry at execution time. npm installation can execute package lifecycle scripts, while `npx cypress open` executes code supplied by the resolved Cypress package and its dependency tree. If a registry account, package release, transitive dependency, or configured registry is compromised, code can run before the user has reviewed the resolved package contents. No malicious package is embedded in this project; the risk arises from mutable dependency resolution and immediate execution. ### Attack Path 1. An attacker compromises a relevant npm package release, transitive dependency, maintainer account, or registry used by the environment. 2. The Agent follows `setup.md` and runs `npm install -D cypress`. 3. npm resolves and installs the mutable package version and dependency graph. 4. Malicious lifecycle code may execute during installation. 5. The subsequent `npx cypress open` command executes the installed package with the permissions of the Agent or user. 6. The compromised code can access files, environment variables, network resources, and project credentials available to that process. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the user running the setup command. The accessible scope can include: - Project source code and test fixtures - Environment variables and CI credentials - User-readable files outside the project - Network services reachable from the workstation ...[truncated 222 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin Cypress to a reviewed exact version: ```bash npm install --save-dev --save-exact cypress@13.6.0 ``` 2. Commit and review `package-lock.json`, then use `npm ci` for reproducible installation. 3. Require explicit user approval before installing or executing third-party packages. 4. Review package provenance, integrity metadata, release history, and transitive dependencies before adoption. 5. Use npm registry allowlisting and lock down `.npmrc` so package resolution cannot silently use an untrusted registry. 6. Run installation and Cypress in a least-privileged container or isolated CI runner without unnecessary secrets. 7. Add dependency scanning and lockfile integrity checks to CI. ]]>