T08 · Insecure Dependencies
Warning
- Location
scripts/setup.sh:18- Finding
Unpinned Playwright Package May Execute Mutable Third-Party Code
- Content
View full analysis
/dev/null; then npx playwright install chromium else error "npx not found. Install Node.js first." fi ``` The same unpinned command is also recommended in `SKILL.md:22-26`: ```bash ### 1. Install Playwright Chromium ```bash npx playwright install chromium ``` ``` ### Technical Analysis The setup script invokes `playwright` through `npx` without declaring an exact package version, lockfile, or integrity constraint. If the package is not already installed locally, `npx` may retrieve package content from the configured npm registry and execute it in the context of the invoking user. Consequently, the effective installation code is mutable after this skill has been reviewed. Exploitation would require compromise or malicious alteration of the resolved package, npm registry, configured registry mirror, or related dependency supply chain. There is no evidence that the current Playwright package is malicious; the weakness is the absence of deterministic dependency resolution. ### Attack Path 1. A user runs `scripts/setup.sh` as documented. 2. The script executes `npx playwright install chromium`. 3. `npx` resolves Playwright from the local environment or configured package registry without an exact version constraint. 4. If the resolved package or its dependency chain has been compromised, attacker-controlled package lifecycle or command code executes under the user's account. 5. The malicious dependency can access data and resources available to that user and may install a modified browser binary or alter user-owned configuration. ### Impact Assessment Successful exploitation provides code execution with the privileges of the user running the setup script. This may per ...[truncated 452 chars]- Remediation
View remediation