T08 · Insecure Dependencies
- Location
scripts/startup.js:67- Finding
Automatic Installation and Execution of an Unpinned Global npm Package
- Content
View full analysis
Vulnerability Details
File Location:
scripts/startup.js:67-91
Vulnerability Type: Unpinned third-party dependency installation and immediate execution
Risk Level: HighVulnerable Code
javascript function installPackage() { log('Installing chrome-ai-action globally...'); try { execSync('npm install -g chrome-ai-action', { stdio: 'inherit' }); const pkgPath = path.join(getGlobalNodeModulesPath(), 'chrome-ai-action'); log(`Installation complete at: ${pkgPath}`); } catch (err) { log(`Failed to install: ${err.message}`); process.exit(1); } } function launchBridge() { const command = isWindows ? 'chrome-ai-action.cmd' : 'chrome-ai-action'; log(`Starting bridge on port ${BRIDGE_PORT}...`); const child = spawn(command, ['--port', String(BRIDGE_PORT)], { stdio: 'inherit', detached: false, }); child.on('error', (err) => { log(`Failed to start bridge: ${err.message}`); process.exit(1); }); child.on('exit', (code) => { if (code !== null && code !== 0) { log(`Bridge exited with code ${code}`); } }); return child; }Technical Analysis
The startup script installs
chrome-ai-actionfrom the configured npm registry without specifying an exact version. It does not use a committed lockfile, expected integrity hash, package provenance validation, or an independently verified artifact. The installed command is then resolved through the operating system search path and executed immediately.Consequently, the effective executable can change after this skill has been reviewed. The risk can materialize if a package maintainer or npm account is compromised, a malicious version is published, the configured registry is replaced or compromised, or package resolution is otherwise manipulated. npm lifecycle scripts may also execute during installation, before the explicit bridge launch occurs.
Global installation increases the effect by modifying the user's shared ...[truncated 2344 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin
chrome-ai-actionto an exact, reviewed version rather than installing the latest registry-selected release. - Declare it as a project-local dependency and commit a lockfile containing integrity metadata. Install with a reproducible command such as
npm ci. - Do not perform automatic global package installation when the skill is loaded. Require explicit user approval before downloading or executing third-party software.
- Verify package provenance, registry origin, publisher identity, and expected integrity before installation.
- Disable npm lifecycle scripts during installation where they are not required, for example with
--ignore-scripts, and separately audit any lifecycle behavior that is required. - Execute the reviewed local binary using an absolute path rather than resolving a command through
PATH. - Vendor the bridge implementation when feasible so that the reviewed source and executed source are identical.
- Run the bridge and browser in a sandbox or dedicated low-privilege account with restricted filesystem, network, and credential access.
- Use a separate browser profile containing no unrelated authenticated sessions or sensitive cookies.
- Re-audit dependency updates before changing the pinned version, including the transitive dependency tree and install scripts.
- Pin