T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:39
- Finding
- Unpinned Third-Party Packages Are Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md:39-42`; `references/cli-commands.md:40-41`; `references/scaffold-stories.md:29-40, 70-73, 109, 165`; `references/pwa-config.md:6`; `references/deployment.md:11, 54, 79, 87, 115, 163` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:39-42`: ```markdown | `sv` | SvelteKit scaffolding | `npm i -g sv` (or use via `pnpx`) | | `pnpm` | Package manager | `npm i -g pnpm` | | `gh` | GitHub repo creation | [cli.github.com](https://cli.github.com) | | `vercel` | Deployment | `npm i -g vercel` | ``` `references/cli-commands.md:40-41`: ```bash pnpx sv create [name] # Scaffold project pnpx sv add [addon] # Add functionality ``` `references/scaffold-stories.md:29-40`: ```bash # 1. Create project (use pnpx if pnpm available, else npx) pnpx sv create [project-name] \ --template minimal \ --types ts cd [project-name] # 2. Add core add-ons pnpx sv add eslint prettier mcp mdsvex tailwindcss vitest playwright # 3. Install dependencies pnpm install ``` `references/scaffold-stories.md:70-73`: ```bash # Install Skeleton (Svelte 5 version) pnpm add @skeletonlabs/skeleton @skeletonlabs/skeleton-svelte # Install Bits UI for headless primitives pnpm add bits-ui ``` `references/scaffold-stories.md:109`: ```bash pnpm add -D vite-plugin-pwa ``` `references/scaffold-stories.md:165`: ```bash pnpm add -D @tailwindcss/typography @tailwindcss/forms ``` `references/pwa-config.md:6`: ```bash npm install -D vite-plugin-pwa ``` `references/deployment.md:11, 54, 79, 87, 115, 163`: ```bash npx sv add sveltekit-adapter ``` ```bash npx sv add sveltekit-adapter # choose: cloudflare, target: pages ``` ```bash npx wrangler pages deploy .svelte-kit/cloudflare ``` ```bash npx sv add sveltekit-adapter # choose: netlify ``` ```text Install the Net ...[truncated 2981 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every directly executed package to an exact reviewed version, for example `pnpx sv@X.Y.Z` and `npx wrangler@X.Y.Z`. 2. Pin project dependencies to exact versions rather than floating ranges where practical. 3. Generate and commit the appropriate lockfile, then use frozen or immutable installation modes in automated workflows. 4. Prefer project-local development dependencies over global installations. 5. Maintain an allowlist of approved package names, versions, registries, and integrity hashes. 6. Verify package provenance, signatures, integrity metadata, maintainer history, and registry origin before upgrading. 7. Review dependency changes and lifecycle scripts before executing newly resolved versions. 8. Use `--ignore-scripts` during installation where lifecycle scripts are unnecessary, enabling only specifically reviewed scripts afterward. 9. Run package installation and scaffolding in an isolated workspace or container with minimal filesystem access and no unrelated credentials. 10. Keep deployment credentials narrowly scoped and avoid exposing them to dependency installation or build steps unless required. 11. Add automated dependency scanning and lockfile review to CI. 12. Document an explicit upgrade process so pinned versions are updated only after security review and testing.