T08 · Insecure Dependencies
- Location
setup.md:72- Finding
Unpinned Third-Party Packages Executed During Setup
- Content
View full analysis
Vulnerability Details
File Location:
setup.md, lines 72–80
Vulnerability Type: Insecure third-party dependency execution
Risk Level: MediumVulnerable Code:
bash # Next.js npx create-next-app@latest my-app --typescript --tailwind --app # Vite (SPA) npm create vite@latest my-app -- --template react-ts # Add shadcn/ui npx shadcn@latest init # Data + state + forms npm install @tanstack/react-query zustand react-hook-form zod @hookform/resolversTechnical Analysis
The setup instructions execute mutable
latestreleases throughnpxandnpm create, then install additional dependencies without pinned versions. The project does not include a lockfile, checksum list, integrity policy, or reviewed version manifest that would make these commands reproducible.Package initializers and dependency lifecycle scripts can execute code with the permissions of the user running the package manager. Consequently, the effective code executed by these instructions can change after this skill has been audited. This is a supply-chain exposure rather than evidence that any currently referenced package is malicious.
Attack Path
- An attacker compromises a referenced package, its registry publisher account, or a transitive dependency.
- The attacker publishes a malicious release that becomes the package's
latestversion or otherwise enters dependency resolution. - A user follows the documented setup commands.
npx,npm create, ornpm installretrieves the compromised package or dependency.- Malicious initializer or lifecycle code executes locally with the invoking user's permissions.
Impact Assessment
Successful exploitation could provide arbitrary code execution under the account running the setup commands. This may permit access to that user's source code, environment variables, package-manager credentials, SSH material, and other readable files. It may also allow mod ...[truncated 316 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace mutable
@latestreferences with explicitly reviewed package versions. - Pin direct dependency versions and commit the generated lockfile.
- Use
npm cifor subsequent reproducible installations. - Review initializer packages and their provenance before execution.
- Enable registry provenance and integrity verification where supported.
- Run initializers in an isolated, least-privileged environment when practical.
- Audit transitive dependencies and package lifecycle scripts before adopting updated versions.
- Establish a controlled dependency-update process so version changes receive review rather than being selected automatically at execution time.
- Replace mutable