T08 · Insecure Dependencies
Warning
- Location
- index.js:10
- Finding
- Automatic Installation of Unpinned Dependencies During Module Import<![CDATA[ ## Vulnerability Details **File Location**: `index.js:10-25` **Vulnerability Type**: Supply-chain exposure through automatic, unpinned dependency installation **Risk Level**: Medium ### Vulnerable Code ```javascript function ensureDependencies() { const deps = ['axios', 'form-data']; const missing = deps.filter(dep => { try { require.resolve(dep); return false; } catch { return true; } }); if (missing.length > 0) { const pkgJsonPath = path.join(__dirname, 'package.json'); try { require.resolve(pkgJsonPath); } catch { execSync(`npm init -y --prefix "${__dirname}" && node -e "const fs=require('fs');const p=JSON.parse(fs.readFileSync('${pkgJsonPath}','utf8'));p.type='module';fs.writeFileSync('${pkgJsonPath}',JSON.stringify(p,null,2))"`, { stdio: 'pipe' }); } execSync(`npm install --prefix "${__dirname}" ${missing.join(' ')}`, { stdio: 'pipe' }); } } ensureDependencies(); ``` ### Technical Analysis Importing `index.js` immediately invokes `ensureDependencies()`. If `axios` or `form-data` cannot be resolved, the Skill runs `npm install` using package names without pinned versions or lockfile verification. This introduces a supply-chain trust boundary at runtime. The effective package content depends on the npm registry and configuration present when the Skill is imported, rather than on artifacts reviewed with the Skill. npm package installation may also execute package lifecycle scripts with the privileges of the current process. Automatic package installation and creation or modification of `package.json` are import-time side effects. They exceed the minimum privileges necessary for loading an API client module because dependency provisioning can be performed explicitly before execution. ### Attack Path 1. The Skill is imported in an environment where one or both dependencies are absent. 2. `ensureDependencies()` executes automatically. 3. The process resolves the unversioned package names through the config ...[truncated 835 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `ensureDependencies()` and all automatic installation behavior from module initialization. 2. Declare dependencies in a committed `package.json` using reviewed, exact versions. 3. Commit a package-lock file and provision dependencies using `npm ci`. 4. Perform dependency installation as a separate, explicit setup step rather than during import. 5. Use registry integrity verification and automated dependency vulnerability scanning. 6. Consider `npm ci --ignore-scripts` if dependency lifecycle scripts are not required. 7. Run installation and execution under a restricted account with minimal filesystem and network permissions. ]]>