T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:187
- Finding
- Unpinned npm Packages Are Downloaded and Executed## Vulnerability Details **File Locations**: - `SKILL.md:187-190` - `setup.md:44-50` - `newman.md:4-6` - `newman.md:74-75` - `newman.md:86-90` - `newman.md:94-98` **Vulnerability Type**: Unpinned third-party package installation and execution **Risk Level**: Medium ### Vulnerable Code `SKILL.md:187-190`: ```bash Or via CLI: ```bash npx openapi-to-postmanv2 -s openapi.yaml -o collection.json ``` ``` `setup.md:44-50`: ```bash If they need automated testing, ensure Newman is installed: ```bash npm install -g newman ``` For HTML reports: ```bash npm install -g newman-reporter-htmlextra ``` ``` `newman.md:4-6`: ```bash ## Installation ```bash npm install -g newman ``` ``` `newman.md:74-75`: ```bash # HTML report (install: npm i -g newman-reporter-htmlextra) newman run collection.json -r htmlextra --reporter-htmlextra-export report.html ``` `newman.md:86-90`: ```yaml ### GitHub Actions ```yaml - name: Run API Tests run: | npm install -g newman newman run collection.json -e ${{ env.ENV }}.json --bail ``` ``` `newman.md:94-98`: ```yaml ### GitLab CI ```yaml api_tests: script: - npm install -g newman - newman run collection.json -e ci.json --reporters cli,junit --reporter-junit-export results.xml ``` ``` ### Technical Analysis The documented commands retrieve mutable package versions from the npm registry without pinning an audited version or verifying package integrity. In particular, `npx openapi-to-postmanv2` can download and immediately execute the currently resolved package. The global installation commands similarly install the latest resolved Newman or reporter package and may execute npm lifecycle scripts during installation. Because no lockfile, integrity hash, package provenance check, or approved version is specified, the code ultimately executed can change after this skill has been reviewed. This ...[truncated 2196 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every dependency to a reviewed, exact version, for example: ```bash npm install --save-dev --save-exact newman@5.3.2 npm install --save-dev --save-exact newman-reporter-htmlextra@1.23.1 npm install --save-dev --save-exact openapi-to-postmanv2@5.0.0 ``` Version examples must be replaced with currently supported versions that have been independently reviewed. 2. Store dependencies in `package.json` and commit the generated lockfile. In CI, install them using: ```bash npm ci --ignore-scripts ``` If a dependency demonstrably requires lifecycle scripts, review those scripts and permit them only in a controlled installation stage. 3. Replace ad hoc `npx` retrieval with the locked project-local executable: ```bash ./node_modules/.bin/openapi2postmanv2 -s openapi.yaml -o collection.json ``` 4. Avoid global package installation. Project-local dependencies provide stronger version isolation, reproducibility, and lockfile enforcement. 5. Verify package provenance, registry source, publisher identity, and lockfile integrity before adoption. Use dependency scanning and npm audit tooling as supplementary controls. 6. Run package installation and API tests in a minimally privileged, isolated environment. Do not expose unrelated CI secrets to the installation step, restrict outbound network access where practical, and use short-lived API credentials. 7. Configure automated dependency updates to require review and security checks rather than silently accepting new package versions.