T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned Global npm Dependency Creates a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 13–17 and 27 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium The skill declares and recommends installation of `@wechatsync/cli` without an exact version or integrity constraint: ```yaml homepage: https://github.com/wechatsync/Wechatsync install: - kind: node package: "@wechatsync/cli" bins: [wechatsync] ``` It also provides the following global installation command: ```markdown 1. **CLI tool** (`@wechatsync/cli`): Open-source npm package ([source code](https://github.com/wechatsync/Wechatsync/tree/v2/packages/cli)). Install with `npm install -g @wechatsync/cli` ``` ### Technical Analysis The dependency has no exact version or integrity hash. Consequently, installation resolves whatever package release the npm registry currently associates with the package name and default distribution tag. The installed code can therefore differ from the code that was reviewed when this skill was authored or audited. npm packages can define lifecycle scripts that execute during installation. If the package, a transitive dependency, its maintainer account, or the relevant registry resolution is compromised, attacker-controlled code could execute with the permissions of the user running the installation. The global installation recommendation increases the package's availability and impact across the user's environment. The package is not demonstrated to be malicious in the audited artifact. The vulnerability is the absence of controls that bind installation to a specific reviewed artifact. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or a transitive dependency and publishes a malicious release under a version selected by the default npm distribution tag. 2. A user follows the documented command `npm install -g @wechatsync/cli`. 3. npm retrieves the mutable, attacker-c ...[truncated 890 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version in both metadata and documentation, for example `@wechatsync/cli@X.Y.Z`, rather than relying on a mutable distribution tag. 2. Record and verify the expected npm artifact integrity hash before installation. 3. Document the trusted registry explicitly and prevent fallback to untrusted or organization-controlled registries where dependency confusion may be possible. 4. Prefer a project-local installation over a global installation so that the dependency is isolated and represented in a lockfile. 5. Commit and enforce a lockfile that pins the complete transitive dependency graph. 6. Review package lifecycle scripts and, where compatible, install with lifecycle scripts disabled, then explicitly perform only the required setup. 7. Require explicit user consent before installing the package, as already stated elsewhere in the skill, and advise users not to install with elevated privileges. 8. Periodically audit the pinned package and its transitive dependencies before updating the approved version.