T08 · Insecure Dependencies
Warning
- Location
- installation.md:26
- Finding
- Unpinned npm and npx Package Execution## Vulnerability Details **File Location**: `installation.md:26-27, 51-53, 62-64`; `v4-migration.md:7-9` **Vulnerability Type**: Unpinned third-party package installation and execution **Risk Level**: Medium ### Vulnerable Code `installation.md:26-27`: ```bash npm install tailwindcss @tailwindcss/vite # or @tailwindcss/postcss / @tailwindcss/cli ``` `installation.md:51-53`: ```bash # CLI route only npx @tailwindcss/cli -i ./src/app.css -o ./dist/app.css --watch --minify ``` `installation.md:62-64`: ```bash npm install -D tailwindcss postcss autoprefixer npx tailwindcss init -p ``` `v4-migration.md:7-9`: ```bash git switch -c tailwind-v4 # clean branch, nothing uncommitted npx @tailwindcss/upgrade ``` ### Technical Analysis These instructions install or execute npm packages without pinning exact, reviewed versions. An unqualified `npx` invocation may download and execute the version currently resolved from the configured package registry when a suitable local package is unavailable. Package installation can also execute lifecycle scripts from the selected package or its dependency tree. The package names are consistent with the Skill's declared Tailwind CSS purpose, and the audit found no evidence of typosquatting or intentional malicious behavior. Nevertheless, the commands create a mutable supply-chain execution boundary: the code that runs can differ from the code available when this Skill was reviewed. The upgrade utility is especially sensitive because it is intentionally allowed to rewrite files throughout the repository. ### Attack Path 1. An attacker compromises a referenced npm package, a maintainer account, a transitive dependency, or the package registry resolution path. 2. The attacker publishes a malicious version or injects malicious package lifecycle or CLI behavior. 3. A user follows the Skill's unpinned `npm install` or `npx` instruction. 4. npm resolves a ...[truncated 1069 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every executable package to an exact reviewed version, for example: ```bash npm install --save-dev --save-exact tailwindcss@4.x.y @tailwindcss/vite@4.x.y npm install --save-dev --save-exact @tailwindcss/cli@4.x.y npm install --save-dev --save-exact @tailwindcss/upgrade@4.x.y ``` 2. Replace remotely resolved `npx` execution with a lockfile-resolved local binary: ```bash npm exec --offline -- @tailwindcss/upgrade ``` Run this only after installing the pinned package and verifying that the selected npm version supports the intended offline behavior. 3. Commit `package-lock.json` and use `npm ci` in CI and other controlled environments to enforce reproducible dependency resolution. 4. Verify package provenance, integrity, publisher identity, and release history before installation. Apply organizational registry allowlists where available. 5. Run migration tools on a clean, isolated branch with no unrelated uncommitted files. Review every resulting change before commit, as the existing migration guide already recommends. 6. Execute package installation and codemods in a restricted environment without unnecessary credentials, secrets, or broad filesystem access. 7. Disable npm lifecycle scripts where they are not required, while first confirming that doing so will not break the reviewed installation workflow: ```bash npm ci --ignore-scripts ``` 8. Update both `installation.md` and `v4-migration.md` so all examples consistently use exact versions and locally installed tools.