T08 · Insecure Dependencies
- Location
installation.md:26- Finding
Unpinned npm and npx Package Execution
- Content
View full analysis
Vulnerability Details
File Location:
installation.md:26-27, 51-53, 62-64;v4-migration.md:7-9
Vulnerability Type: Unpinned third-party package installation and execution
Risk Level: MediumVulnerable Code
installation.md:26-27:bash npm install tailwindcss @tailwindcss/vite # or @tailwindcss/postcss / @tailwindcss/cliinstallation.md:51-53:bash # CLI route only npx @tailwindcss/cli -i ./src/app.css -o ./dist/app.css --watch --minifyinstallation.md:62-64:bash npm install -D tailwindcss postcss autoprefixer npx tailwindcss init -pv4-migration.md:7-9:bash git switch -c tailwind-v4 # clean branch, nothing uncommitted npx @tailwindcss/upgradeTechnical Analysis
These instructions install or execute npm packages without pinning exact, reviewed versions. An unqualified
npxinvocation may download and execute the version currently resolved from the configured package registry when a suitable local package is unavailable. Package installation can also execute lifecycle scripts from the selected package or its dependency tree.The package names are consistent with the Skill's declared Tailwind CSS purpose, and the audit found no evidence of typosquatting or intentional malicious behavior. Nevertheless, the commands create a mutable supply-chain execution boundary: the code that runs can differ from the code available when this Skill was reviewed.
The upgrade utility is especially sensitive because it is intentionally allowed to rewrite files throughout the repository.
Attack Path
- An attacker compromises a referenced npm package, a maintainer account, a transitive dependency, or the package registry resolution path.
- The attacker publishes a malicious version or injects malicious package lifecycle or CLI behavior.
- A user follows the Skill's unpinned
npm installornpxinstruction. - npm resolves a ...[truncated 1069 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin every executable package to an exact reviewed version, for example:
bash npm install --save-dev --save-exact tailwindcss@4.x.y @tailwindcss/vite@4.x.y npm install --save-dev --save-exact @tailwindcss/cli@4.x.y npm install --save-dev --save-exact @tailwindcss/upgrade@4.x.y -
Replace remotely resolved
npxexecution with a lockfile-resolved local binary:bash npm exec --offline -- @tailwindcss/upgradeRun this only after installing the pinned package and verifying that the selected npm version supports the intended offline behavior.
-
Commit
package-lock.jsonand usenpm ciin CI and other controlled environments to enforce reproducible dependency resolution. -
Verify package provenance, integrity, publisher identity, and release history before installation. Apply organizational registry allowlists where available.
-
Run migration tools on a clean, isolated branch with no unrelated uncommitted files. Review every resulting change before commit, as the existing migration guide already recommends.
-
Execute package installation and codemods in a restricted environment without unnecessary credentials, secrets, or broad filesystem access.
-
Disable npm lifecycle scripts where they are not required, while first confirming that doing so will not break the reviewed installation workflow:
bash npm ci --ignore-scripts -
Update both
installation.mdandv4-migration.mdso all examples consistently use exact versions and locally installed tools.
-