T08 · Insecure Dependencies
Error
- Location
- SKILL.md:45
- Finding
- Execution of an Unpinned npm Package Using the Mutable latest Tag<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 45, 51, 57, 66, 69, 72, and 278 **Vulnerability Type**: Supply-chain risk from unpinned third-party executable dependencies **Risk Level**: High ### Vulnerable Code ```bash npx daxiapi-cli@latest config get token ``` ```bash npx daxiapi-cli@latest config set token YOUR_TOKEN_FROM_DAXIAPI ``` The same mutable dependency reference is used for search and all three news-query operations: ```bash npx daxiapi-cli@latest search <company-name> npx daxiapi-cli@latest news sentiment -c <code> -p 30 npx daxiapi-cli@latest news notice -c <code> -p 20 -i 1 npx daxiapi-cli@latest news report -c <code> -p 25 -i 1 -b <start-date> -e <end-date> ``` ### Technical Analysis The Skill instructs the Agent to execute `daxiapi-cli` through `npx` using the mutable `@latest` tag. When the package is not already available locally, `npx` can download and immediately execute package-controlled code. The package version executed during a future Skill invocation may therefore differ from the version available when the Skill was reviewed. The project provides no exact version constraint, lockfile, integrity hash, vendored dependency, or package-provenance verification. A malicious package update or compromised publisher account could consequently turn an otherwise legitimate command into arbitrary code execution. The dependency is also used for API-token configuration. A malicious release executing in that context could potentially access the supplied token, inherited environment variables, files readable by the invoking account, and available network resources. ### Attack Path 1. An attacker compromises the npm publisher account, package publication pipeline, or another component capable of publishing a new `daxiapi-cli` release. 2. The attacker publishes a malicious version and causes it to resolve through the `latest` distribution tag. 3. A user or Agent follows the Skill instructions and invokes an `npx daxi ...[truncated 1208 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a reviewed, exact package version in every command, for example: ```bash npx --yes daxiapi-cli@1.2.3 ... ``` 2. Record the dependency in `package.json` and commit the generated lockfile so that package versions and transitive dependencies are reproducible. 3. Use lockfile-enforcing installation methods such as `npm ci` rather than resolving dependencies dynamically during each Skill execution. 4. Verify package provenance and integrity through a trusted registry, npm provenance metadata, and lockfile integrity hashes before execution. 5. Review the pinned package and its transitive dependencies before approving a version upgrade. Use an explicit update process rather than automatically tracking `latest`. 6. Run the CLI in a restricted environment with only the filesystem access, environment variables, and network destinations required for the task. 7. Avoid exposing token values in command output or Agent logs. Confirm that token-retrieval commands mask secrets, and prefer a secure credential store or narrowly scoped environment variable. 8. Use a minimally privileged, revocable API token and rotate it immediately if package compromise or unintended disclosure is suspected. ]]>