T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:10
- Finding
- Unpinned Global Installation of a Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10-21 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```yaml install: npm install -g m365-cli ``` ```markdown ## Prerequisites - Node.js 18+ - `m365-cli` installed globally: `npm install -g m365-cli` ``` ### Technical Analysis The Skill directs users or agents to install the latest available release of `m365-cli` globally. No exact version, package integrity value, lockfile, or reviewed release is specified. npm packages may define lifecycle scripts that execute during installation. Because the installation is global, a compromised or unexpectedly modified upstream release could place or replace executables in the user's global npm binary directory. The effective installed code may therefore differ from the code reviewed when this Skill was published. The package provenance is documented, but repository and npm links alone do not provide release immutability or integrity verification. ### Attack Path 1. The upstream npm publisher account, build pipeline, or package distribution process is compromised. 2. An attacker publishes a malicious release under the legitimate `m365-cli` package name. 3. A user or agent follows the Skill instruction and runs `npm install -g m365-cli`. 4. npm retrieves the latest release and may execute its installation lifecycle scripts. 5. The malicious package executes with the installing user's privileges and installs a globally accessible `m365` executable. 6. Subsequent Microsoft 365 operations may be intercepted or altered by the compromised CLI. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user performing the installation. A malicious CLI could access files available to that user, intercept Microsoft 365 command arguments and output, misuse OAuth-backed operations, or impersonate expected `m365` behavior. The glo ...[truncated 204 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version, for example: ```bash npm install -g m365-cli@<reviewed-version> ``` 2. Document the expected package version and integrity hash. 3. Prefer a project-local installation with a committed lockfile instead of a global installation. 4. Install with lifecycle scripts disabled when compatible with the package: ```bash npm install --ignore-scripts m365-cli@<reviewed-version> ``` 5. Verify the npm publisher, source repository tag, release provenance, and package contents before updating the pinned version. 6. Consider running the CLI in a restricted environment that exposes only the files and network destinations required for the requested Microsoft 365 operation. ]]>