T08 · Insecure Dependencies
Warning
- Location
INSTALL.md:37- Finding
Unpinned Global Installation of a Third-Party npm Package
- Content
View full analysis
nul || npm install -g mcporter ``` The Skill metadata also declares the same package without a version constraint: ```yaml "requires": { "bins": ["mcporter"] }, "install": [ { "id": "node", "kind": "node", "package": "mcporter", "bins": ["mcporter"], "label": "Install mcporter (node)", }, ], ``` ### Technical Analysis The installation instructions retrieve and globally install the latest version of the `mcporter` npm package without an exact version, lockfile, integrity hash, signature verification, or documented publisher validation. Because npm dependencies may execute lifecycle scripts during installation, the effective code executed on a user's system can change after this Skill has been reviewed. A compromised package release, compromised maintainer account, registry substitution, or unexpected future release could introduce arbitrary code into the installation process. The global `-g` installation increases the affected scope because the resulting command becomes available across projects for the installing user. The audit did not establish that the current package is malicious; the vulnerability is the absence of controls ensuring that the reviewed dependency is the dependency subsequently installed. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or its dependency chain. 2. The attacker publishes a malicious package version or introduces a malicious lifecycle script. 3. A user follows the documented installation procedure without already having `mcporter`. 4. `npm install -g mcporter` resolves the attacker-controlled or otherwise unreviewed cu ...[truncated 961 chars]- Remediation
View remediation
``` 2. Publish the expected package name, version, publisher identity, and integrity hash in the installation documentation. 3. Verify package provenance and signatures where supported by the distribution mechanism. 4. Prefer a project-local dependency with a committed lockfile over a global installation. 5. Disable npm lifecycle scripts during installation where compatible: ```bash npm install --ignore-scripts --save-exact mcporter@ ``` 6. Review the pinned package and its transitive dependencies before distribution. 7. Add automated dependency monitoring, but require review before updating the pinned version. 8. Update the Skill metadata so its automated installer uses the same exact reviewed version. ]]>