T08 · Insecure Dependencies
Warning
- Location
- scripts/create.sh:38
- Finding
- Unpinned npm Dependencies Allow Non-Reproducible Supply-Chain Code Execution## Vulnerability Details **File Location**: `scripts/create.sh`, lines 38–41 **Vulnerability Type**: Unpinned third-party dependencies and unsafe package installation **Risk Level**: Medium ### Vulnerable Code ```bash npm install --save-exact remotion @remotion/cli @remotion/tailwind > /dev/null 2>&1 # Install dev deps npm install -D typescript @types/react tailwindcss > /dev/null 2>&1 ``` ### Technical Analysis The script resolves npm packages from mutable registry tags without specifying audited version numbers. Although `--save-exact` records the versions selected for the first group after installation, it does not constrain which versions are initially downloaded. Every execution can therefore resolve a different package version. The development dependencies are also installed without explicit versions and, by default, are normally saved using semver ranges. No pre-audited lockfile is supplied by the skill before these installations. npm may execute package lifecycle scripts during installation. Consequently, a compromised new release, compromised maintainer account, malicious transitive dependency, or registry resolution attack could cause attacker-controlled code to execute while `create.sh` is running. Redirecting all npm output to `/dev/null` also suppresses warnings and information that could help users detect unexpected package behavior. ### Attack Path 1. An attacker compromises a listed npm package, one of its transitive dependencies, or the relevant registry publishing account. 2. The attacker publishes a malicious version that satisfies the mutable tag or dependency range resolved by npm. 3. A user runs `scripts/create.sh` after that version becomes available. 4. The script downloads the newly resolved package without comparing it against a reviewed lockfile or approved version manifest. 5. npm executes any applicable lifecycle script with the privileges of the user running `create.sh`. 6. Th ...[truncated 1022 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct dependency to a reviewed version, including development dependencies: ```bash npm install --save-exact \ remotion@APPROVED_VERSION \ @remotion/cli@APPROVED_VERSION \ @remotion/tailwind@APPROVED_VERSION \ typescript@APPROVED_VERSION \ @types/react@APPROVED_VERSION \ tailwindcss@APPROVED_VERSION ``` 2. Distribute a reviewed `package.json` and `package-lock.json` as part of the skill template, then install with: ```bash npm ci ``` This ensures that dependency versions and integrity hashes match the audited lockfile. 3. Regularly scan and review the lockfile with dependency-auditing and software-composition-analysis tooling before updating it. 4. Where package functionality permits, disable lifecycle scripts during installation: ```bash npm ci --ignore-scripts ``` If specific scripts are required, execute only explicitly reviewed setup steps afterward. 5. Do not suppress all installation output. Preserve logs in CI and present npm errors and security warnings to the user. 6. Run project creation in a non-privileged, isolated environment without unrelated credentials or sensitive environment variables.