T08 · Insecure Dependencies
Warning
- Location
- app/package.json:13
- Finding
- Unpinned Electron Dependency and Automatic Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `app/package.json:13-15`, `scripts/launch.sh:22-25`, `SKILL.md:29-33` **Vulnerability Type**: Unpinned third-party dependency and non-reproducible installation **Risk Level**: Medium ### Vulnerable Code `app/package.json:13-15`: ```json "devDependencies": { "electron": "^34.0.0" } ``` `scripts/launch.sh:22-25`: ```bash if [ ! -d "node_modules" ]; then echo "Installing dependencies (first run only)..." npm install fi ``` `SKILL.md:29-33`: ```bash cd <skill_dir>/app npm install ``` ### Technical Analysis The project does not include a dependency lockfile and declares Electron using the mutable version range `^34.0.0`. Consequently, separate installations can resolve different Electron versions and transitive dependency graphs. The launcher automatically invokes `npm install` when `node_modules` is absent. npm installation can download packages from the configured registry and execute package lifecycle scripts with the privileges of the invoking user. The subsequent `npx electron .` command executes the installed Electron package. No malicious dependency is present in the reviewed source, and Electron is a legitimate package. The weakness is that installation is not deterministic and depends on the integrity of the registry, npm configuration, package publisher account, and dependency versions available at installation time. ### Attack Path 1. A user invokes `scripts/launch.sh` on a system where `node_modules` does not exist, or manually follows the documented `npm install` instructions. 2. npm resolves `electron` and its transitive dependencies without a reviewed lockfile. 3. An attacker compromises the configured npm registry, a relevant publisher account, the local npm registry configuration, or a future dependency release accepted by the version range. 4. npm downloads the attacker-controlled package content. 5. Malicious lifecycle code can execute during installation, or malicious runtim ...[truncated 586 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin Electron to a reviewed exact version rather than a mutable range: ```json "devDependencies": { "electron": "34.0.0" } ``` 2. Generate, review, and commit `package-lock.json`. 3. Replace automatic `npm install` with deterministic installation: ```bash npm ci ``` 4. Configure npm to use an explicitly trusted registry and enforce HTTPS. 5. Review dependency changes and lockfile diffs before upgrading. 6. Use automated dependency vulnerability and integrity scanning in CI. 7. Where compatible with the installation process, consider disabling package lifecycle scripts: ```bash npm ci --ignore-scripts ``` 8. Avoid using `npx` where resolution could be ambiguous. Invoke the installed, locked binary through an npm script or an explicit local path. ]]>