T08 · Insecure Dependencies
Error
- Location
- SKILL.md:260
- Finding
- Unpinned npm Package Execution with Access to API Credentials< 个人主页 2. 开通API Token功能 3. 获取生成的Token **步骤 3.3：配置Token** ```bash # 方式一：通过CLI配置（推荐） npx daxiapi-cli@latest config set token YOUR_TOKEN_FROM_DAXIAPI # 方式二：设置环境变量 export DAXIAPI_TOKEN=YOUR_TOKEN_FROM_DAXIAPI ``` **步骤 3.4：验证配置** ```bash npx daxiapi-cli@latest market ``` ``` The same unsafe package selector is also used at `SKILL.md:349-350` and `references/field-descriptions.md:168-174`. ### Technical Analysis The Skill instructs the agent or user to execute `daxiapi-cli@latest` through `npx`. Unless already available locally, `npx` may retrieve the selected package from the npm registry and immediately execute its code. The `@latest` selector is mutable and provides no guarantee that the package executed in the future is the version that was reviewed. The package is also given direct access to the DaxiAPI credential. It receives the token through the `config set token` argument or can inherit `DAXIAPI_TOKEN` from the process environment. A compromised publisher account, malicious future release, or npm ecosystem compromise could therefore convert this documented workflow into arbitrary code execution with the invoking process's privileges and credential access. This is a supply-chain vulnerability rather than evidence that the current package is malicious. No version, lockfile, checksum, or integrity constraint is provided by the Skill. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution channel, or a future release of `daxiapi-cli`. 2. The attacker publishes a malicious version and makes it the package's `latest` release. 3. An agent or user follows the Skill and runs ` ...[truncated 1026 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed version: ```bash npx --yes daxiapi-cli@X.Y.Z ... ``` 2. Pin dependency integrity through a committed lockfile and verify the package's registry integrity hash. 3. Prefer a preinstalled, approved binary over downloading executable code during every Skill invocation. 4. Verify the npm package name, publisher identity, provenance attestations, and release signatures where available. 5. Execute the CLI in a restricted environment with: - Access only to the required DaxiAPI host. - No access to unrelated environment variables. - Minimal filesystem permissions. - No access to SSH keys, cloud credentials, or unrelated configuration files. 6. Pass credentials only to operations that require authentication. Avoid broadly exporting the token into an environment inherited by child processes. 7. Establish an update-review process so a new package version is tested and audited before changing the pinned version. ]]>