T08 · Insecure Dependencies
Warning
- Location
scripts/bundle-artifact.sh:22- Finding
Unpinned Third-Party Packages Are Downloaded and Executed at Runtime
- Content
View full analysis
/dev/null 2>&1; then echo "📦 Installing bundling dependencies..." npm install -D parcel @parcel/config-default parcel-resolver-tspaths html-inline fi # Create .parcelrc if it doesn't exist if [ ! -f ".parcelrc" ]; then echo "⚙️ Creating Parcel config..." cat > .parcelrc << 'EOF' { "extends": "@parcel/config-default", "resolvers": ["parcel-resolver-tspaths", "..."] } EOF fi # Build with Parcel echo "🔨 Building with Parcel..." npx parcel build index.html --no-source-maps --dist-dir dist-parcel # Inline all assets echo "📄 Inlining assets into single HTML..." npx html-inline -i dist-parcel/index.html -o bundle.html -b dist-parcel ``` Other affected workflows use mutable package selectors such as: ```bash npm create vite@latest "$PROJECT_NAME" -- --template react-ts npx create-next-app@latest "$PROJECT_NAME" npx nuxi@latest init "$PROJECT_NAME" npx shadcn@latest init -y -d npx shadcn-vue@latest init -y -d ``` ### Technical Analysis The initialization and bundling workflows download and execute third-party npm packages without pinning them to reviewed, immutable versions. Explicit `@latest` selectors guarantee that the effective code can change after this Skill has been audited. Bare package specifications also resolve according to the current registry state when no repository-contro ...[truncated 2415 chars]- Remediation
View remediation