T08 · Insecure Dependencies
- Location
SKILL.md:12- Finding
Unpinned npm Dependency Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 12–17
Vulnerability Type: Unpinned third-party dependency
Risk Level: MediumVulnerable Code
yaml requires: bins: ["node"] install: - id: npm kind: command command: "npm install node-fetch" bins: ["node"] label: "Install fetch (if needed)"Technical Analysis
The installation command requests
node-fetchwithout specifying an exact version or supplying a lockfile or other integrity constraint. npm therefore resolves a mutable package version and dependency graph at installation time. The code installed in the future may differ from the code that existed when this Skill was reviewed.This creates a supply-chain exposure: compromise of the package, one of its transitive dependencies, its publishing credentials, or the package registry could cause users to install altered code. Any applicable npm lifecycle scripts may execute during installation, while imported dependency code executes later with the privileges of the process using the Skill.
The audit found no evidence that
node-fetchis currently malicious. The vulnerability is the absence of reproducible and integrity-verified dependency resolution.Attack Path
- An attacker compromises the npm publishing path for
node-fetchor a dependency resolved by the installation. - The attacker publishes a malicious or backdoored package version that satisfies the unconstrained request.
- A user installs the Skill and the configured command runs
npm install node-fetch. - npm resolves and downloads the attacker-controlled release because no exact version or lockfile constrains resolution.
- Malicious behavior executes through a lifecycle script, if present and applicable, or when the dependency is subsequently loaded.
- The payload operates with the permissions and environmental access of the installing or executing user.
Impact Assessment
Successful exploitation could execute arbitrary ...[truncated 559 chars]
- An attacker compromises the npm publishing path for
- Remediation
View remediation
Remediation Suggestions
- Remove
node-fetchwhen the supported Node.js version provides the built-in standards-compatiblefetchAPI. - If the package remains necessary, pin an audited exact version rather than using an unconstrained package name.
- Commit a generated lockfile containing dependency versions and integrity hashes.
- Replace ad hoc installation with
npm ci, ensuring installation follows the committed lockfile without silently updating dependency versions. - Review direct and transitive dependencies before release and use automated vulnerability and package-provenance checks.
- In controlled deployment environments, consider disabling lifecycle scripts with
--ignore-scriptswhen package functionality permits it. - Document the minimum supported Node.js version and dependency rationale so users can determine whether the external package is required.
- Remove