T08 · Insecure Dependencies
Warning
- Location
SKILL.md:9- Finding
Unpinned Third-Party Package Is Installed and Executed as a Background Daemon
- Content
View full analysis
/tmp/bnbot.log 2>&1 & sleep 1 lsof -i :18900 -P 2>/dev/null | grep LISTEN ``` ### Technical Analysis The installation metadata requests `bnbot-cli` from npm without specifying an exact version or package-integrity digest. The instructions subsequently launch code supplied by that dependency as a persistent background process for the current host session. Because dependency resolution is not pinned to an audited artifact, the code installed at different times can differ from the version originally reviewed. A malicious or compromised future package release could therefore execute arbitrary commands under the account running the Skill. The daemon is also designed to communicate with a Chrome extension operating in an authenticated Twitter/X browser session. Consequently, compromise of the dependency could potentially affect both local resources available to the process and social-media operations exposed through that extension. The repository contains only documentation and no implementation of the npm package or extension, so their internal controls and actual network behavior could not be verified in this audit. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution process, or another component responsible for publishing `bnbot-cli`. 2. The attacker publishes a malicious release under the expected package name. 3. A user installs the Skill after that release becomes the version selected by npm because no exact version or integrity digest is specified. 4. The setup instructions cause the user or agent to run `b ...[truncated 1200 chars]- Remediation
View remediation