T08 · Insecure Dependencies
Warning
- Location
- package.json:30
- Finding
- Unpinned and Unnecessary npm Dependency<![CDATA[ ## Vulnerability Details **File Location**: `package.json:30-32` **Vulnerability Type**: Unpinned third-party dependency and unnecessary supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```json "dependencies": { "ffmpeg": "*" } ``` ### Technical Analysis The package accepts any version of the npm package named `ffmpeg`. No lockfile is present in the audited directory, so dependency resolution can change between installations. The shell implementation does not import or invoke this npm package. It directly executes the system `ffmpeg` binary, and the installation documentation also instructs users to install that binary through their operating system. The npm dependency therefore appears unnecessary for the declared functionality. Using the unrestricted `*` version range introduces avoidable supply-chain risk. A compromised or malicious future package release may be selected when a user runs `npm install`, potentially including lifecycle scripts that execute during installation. ### Attack Path 1. An attacker compromises the npm package or an authorized publisher account. 2. The attacker publishes a malicious version matching the `*` range. 3. A user or automated deployment runs `npm install`. 4. npm resolves the unrestricted dependency to the malicious version. 5. Package lifecycle code executes with the privileges of the installing user or build environment. ### Impact Assessment Successful exploitation could execute arbitrary code as the account performing package installation. Depending on the installation environment, this could expose environment variables, Feishu and Volcengine credentials, workspace files, or CI/CD secrets. It could also modify project artifacts or establish persistence available to that user. No evidence was found that the currently declared package version is malicious; the issue is the unnecessary and unrestricted dependency resolution policy. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the npm `ffmpeg` dependency because the implementation uses the system executable. 2. Add an explicit prerequisite check before processing: ```bash if ! command -v ffmpeg >/dev/null 2>&1; then echo "ffmpeg is required" >&2 exit 1 fi ``` 3. If a JavaScript dependency later becomes necessary, pin an exact reviewed version rather than using `*`. 4. Commit a lockfile and use reproducible installation commands such as `npm ci`. 5. Disable lifecycle scripts where they are not required and incorporate dependency integrity and vulnerability scanning into release workflows. ]]>