T08 · Insecure Dependencies
Warning
- Location
SKILL.md:63- Finding
Unpinned Third-Party Package and Mutable CDN Dependency
- Content
View full analysis
``` ### Technical Analysis The installation commands do not specify an exact reviewed version of `beautiful-mermaid`. Package managers may therefore resolve a later release whose contents differ from those expected when this Skill was reviewed. Although the documentation states compatibility with version `v0.1.x`, the commands do not enforce that range or an exact version. The browser example likewise uses an unversioned UNPKG URL and does not specify a Subresource Integrity hash. The URL resolves through the package's mutable default version, allowing the effective JavaScript loaded by a page to change after this Skill has been audited. No evidence was found that the current `beautiful-mermaid` package or CDN asset is malicious. The vulnerability is the absence of controls that bind installation and execution to a known, reviewed artifact. ### Attack Path 1. An attacker compromises the package publisher account, package registry, CDN distribution path, or another component of the dependency publication process. 2. The attacker publishes or causes the mutable package reference to resolve to a malicious release. 3. A user follows one of the unpinned package installation commands or includes the unversioned CDN script. 4. The package manager or browser retrieves content that was not covered by the original review. 5. Malicious package lifecycle code, imported runtime code, or browser JavaScript executes in the consuming environment. ### Impact Assessment For Node.js or Bu ...[truncated 795 chars]- Remediation
View remediation
``` 4. Generate and independently verify the integrity hash against the reviewed artifact before publishing the example. Do not use a placeholder integrity value in production. 5. Prefer self-hosting the reviewed browser bundle where operationally feasible, combined with a restrictive Content Security Policy. 6. Review dependency updates before changing the pinned version, including package contents, lifecycle scripts, maintainer changes, provenance, and published checksums. ]]>