T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:43
- Finding
- Unpinned npm Package Execution Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:43-67`; `setup.md:23-27`; `cli-commands.md:4-59`; `deployment-patterns.md:7-51`; `netlify-toml.md:59` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:43-67`: ```bash npx netlify status ``` ```bash git remote get-url origin npx netlify link --git-remote-url <remote-url> ``` ```bash npx netlify deploy ``` ```bash npx netlify deploy --prod ``` ```bash npm run build npx netlify deploy --dir=dist ``` `setup.md:23-27`: ```text 1. `npx netlify status` 2. `git remote get-url origin` (if repo exists) 3. `npx netlify link --git-remote-url <remote>` or `npx netlify init` 4. `npx netlify deploy` (preview first) ``` `cli-commands.md:4-59`: ```bash npx netlify login npx netlify status npx netlify logout ``` ```bash npx netlify link npx netlify link --git-remote-url <url> npx netlify init npx netlify unlink ``` ```bash npx netlify deploy npx netlify deploy --prod npx netlify deploy --dir=dist npx netlify deploy --message="release note" npx netlify deploy:list ``` ```bash npx netlify env:list npx netlify env:set KEY value npx netlify env:get KEY npx netlify env:import .env ``` ```bash npx netlify build npx netlify build --dry ``` ```bash npx netlify --version npx netlify status --verbose npx netlify help deploy ``` ```bash npx netlify open npx netlify open:admin npx netlify open:site ``` `deployment-patterns.md:7-51` includes the same unversioned execution pattern: ```text Authenticated? |- No -> npx netlify login `- Yes -> Linked? |- No -> Try link by git remote | |- Success -> preview deploy | `- Fail -> npx netlify init `- Yes -> deploy mode? |- Preview -> npx netlify deploy `- Production -> npx netlify deploy --prod ``` `netlify-toml.md:59`: ```bash npx netlify build --dry ``` ### Technical Analysis The Skill consistently invokes `npx netlify` without specifying an exact package name ...[truncated 2514 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace ambiguous, unversioned execution with the verified official npm package and an exact audited version: ```bash npx --yes netlify-cli@<audited-version> status npx --yes netlify-cli@<audited-version> deploy ``` 2. Prefer installing the CLI as a pinned development dependency: ```bash npm install --save-dev --save-exact netlify-cli@<audited-version> ``` Then invoke the lockfile-controlled binary: ```bash npm exec -- netlify status npm exec -- netlify deploy ``` 3. Commit and enforce the package lockfile. Use reproducible installation commands such as `npm ci` rather than allowing implicit dependency updates. 4. Verify the selected package name, publisher, registry source, and integrity metadata before documenting or executing it. 5. Configure an approved npm registry explicitly in controlled environments and prevent unexpected project or user-level npm configuration from redirecting package resolution to an untrusted registry. 6. Update every occurrence in `SKILL.md`, `setup.md`, `cli-commands.md`, `deployment-patterns.md`, and `netlify-toml.md` so that no fallback workflow reintroduces unpinned `npx netlify` execution. 7. Review and deliberately upgrade the pinned version on a controlled schedule. Test authentication, build, environment-variable, and deployment operations before approving a new version. ]]>