T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:54
- Finding
- Mutable third-party packages are downloaded and executed without integrity controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:54-83`, `SKILL.md:109-126`, and `SKILL.md:188-198` **Vulnerability Type**: Supply-chain exposure through mutable and unpinned npm/npx dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g tallyca ``` ```bash npm install -g tallyca@latest ``` ```bash npm view tallyca version ``` ```bash sudo yum install -y \ alsa-lib atk at-spi2-atk cups-libs libdrm libXcomposite \ libXdamage libXrandr mesa-libgbm pango gtk3 npx playwright install chromium npx playwright install-deps chromium ``` ```bash sudo apt-get update sudo apt-get install -y \ libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 \ libxcomposite1 libxdamage1 libxrandr2 libgbm1 \ libpango-1.0-0 libcairo2 libasound2 libatspi2.0-0 npx playwright install chromium npx playwright install-deps chromium ``` The recovery workflow also states: ```text If missing or too old: npm install -g tallyca@latest ``` The maintainer instructions identify the dependency ambiguously: ```text Publish tallyca to npm (tally-pdf-cli package). ``` ### Technical Analysis The Skill directs the agent to download and execute mutable third-party packages. In particular, `tallyca@latest` does not identify an immutable, audited artifact. Its effective contents can change after this Skill has been reviewed. npm installation can run package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Those scripts execute with the permissions of the account running npm. A compromised publisher account, malicious package update, registry compromise, or dependency-confusion event could therefore turn the documented installation step into arbitrary local code execution. The unversioned `npx playwright` commands introduce similar risk. Depending on the environment and locally installed packages, `npx` may retrieve executable package content from the npm registry. No lockfile, integrity hash, package provenance check, or trusted-publi ...[truncated 2065 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `tallyca@latest` with an exact, reviewed package version. 2. Verify and consistently document the official package name, publisher, registry, and source repository. Resolve the `tallyca` versus `tally-pdf-cli` ambiguity. 3. Pin all direct and transitive dependencies through a lockfile where deployment architecture permits. 4. Verify package integrity using registry integrity metadata, checksums, signatures, or npm provenance attestations. 5. Install dependencies locally in a dedicated application directory rather than globally. 6. Run installation and PDF generation under an isolated, unprivileged service account. 7. Pin Playwright to an audited version and invoke the locally installed binary rather than an unversioned `npx` command. 8. Disable npm lifecycle scripts with `--ignore-scripts` unless they are explicitly required. If required, audit the relevant scripts before deployment. 9. Perform upgrades through a controlled maintenance process rather than automatically installing the newest registry release during normal Skill execution. 10. Use dependency scanning and publisher-change monitoring before approving new versions. ]]>