T08 · Insecure Dependencies
Warning
- Location
- references/examples.md:1033
- Finding
- Unpinned Third-Party Packages Executed in the CI Pipeline## Vulnerability Details **File Location**: `references/examples.md`, lines 1033-1064 **Vulnerability Type**: Unpinned executable CI dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml - name: Start application run: | npm start & npx wait-on http://localhost:3000 - name: Install accessibility testing tools run: | npm install -g @axe-core/cli npm install -g pa11y npm install -g lighthouse - name: Run axe-core accessibility tests run: | axe http://localhost:3000 \ --tags wcag2a,wcag2aa,wcag21aa \ --reporter json \ --output axe-results.json - name: Run Pa11y accessibility tests run: | pa11y http://localhost:3000 \ --standard WCAG2AA \ --reporter json \ --output pa11y-results.json - name: Run Lighthouse accessibility audit run: | lighthouse http://localhost:3000 \ --only-categories=accessibility \ --output=json \ --output-path=lighthouse-a11y.json \ --chrome-flags="--headless" - name: Run Playwright accessibility tests run: npx playwright test tests/accessibility/ ``` ### Technical Analysis The example CI workflow installs globally or invokes several npm packages without specifying reviewed, immutable versions. The global `npm install` commands resolve the currently published versions of `@axe-core/cli`, `pa11y`, and `lighthouse`. Likewise, `npx wait-on` and `npx playwright` may download packages from the configured registry if suitable local installations are unavailable. This behavior makes the code executed by the workflow mutable without any corresponding change to the repository. Package installation can execute package lifecycle scripts, while the resulting CLI tools execute directly inside the CI runner. A c ...[truncated 2204 chars]
- Remediation
- ## Remediation Suggestions 1. Add all accessibility tools and helper CLIs to the project's `devDependencies` using exact, reviewed versions: ```json { "devDependencies": { "@axe-core/cli": "REVIEWED_EXACT_VERSION", "lighthouse": "REVIEWED_EXACT_VERSION", "pa11y": "REVIEWED_EXACT_VERSION", "playwright": "REVIEWED_EXACT_VERSION", "wait-on": "REVIEWED_EXACT_VERSION" } } ``` 2. Commit the generated `package-lock.json` and continue installing dependencies exclusively with `npm ci`. 3. Remove global `npm install -g` commands from the workflow. 4. Invoke lockfile-installed binaries through package scripts or `npx --no-install`, which prevents `npx` from silently downloading missing packages: ```yaml - name: Start application run: | npm start & npx --no-install wait-on http://localhost:3000 - name: Run Playwright accessibility tests run: npx --no-install playwright test tests/accessibility/ ``` 5. Use dependency review, automated update tooling, provenance verification, and periodic package audits before accepting version changes. 6. Define explicit least-privilege GitHub Actions permissions, such as `contents: read`, and grant pull-request write access only to the specific job that requires it. 7. Pin third-party GitHub Actions to reviewed immutable commit SHAs rather than mutable major-version tags. 8. Avoid exposing repository secrets to workflows triggered by untrusted pull-request content.