T08 · Insecure Dependencies
Error
- Location
scripts/browse.sh:91- Finding
Unpinned Third-Party npm Package Is Downloaded and Executed at Runtime
- Content
View full analysis
/dev/null && return 0 ``` ### Technical Analysis The HTML-processing path invokes `npx -y playwright-cli-extra` without specifying an exact package version or verifying package integrity. The `-y` option suppresses confirmation, allowing npm to download and execute the registry-selected package automatically. Consequently, the code executed during a future Skill invocation is not fully represented by the reviewed repository. A compromised npm account, malicious future package release, or compromised registry response could alter the effective payload after this audit. Execution occurs inside a Docker container, which limits direct host filesystem access because this branch does not mount a host directory. However, the container retains outbound network access by default and can process the supplied URL and any page content returned to it. Container isolation also depends on the security of the Docker runtime and image. ### Attack Path 1. An attacker compromises the `playwright-cli-extra` package, its maintainer account, or the dependency distribution path. 2. The attacker publishes a malicious release that becomes the version selected by unversioned `npx`. 3. A user invokes `browse.sh` with `--html`. 4. If Level 1 does not complete successfully, execution reaches the Level 2 HTML branch. 5. `npx -y` downloads and executes the attacker-controlled package without user confirmation. 6. The malicious package can execute arbitrary commands inside the container, inspect data available to that process, and communicate over the container's network. ### Impact Assessment Successful exploitation provides arbitrary code execution within the tra ...[truncated 433 chars]- Remediation
View remediation