T08 · Insecure Dependencies
- Location
scripts/md_to_ppt.py:631- Finding
Typographical Error in npx Command Can Execute an Unintended Registry Package
- Content
View full analysis
Vulnerability Details
File Location:
scripts/md_to_ppt.py:631-645
Additional Locations:scripts/md_to_ppt.py:731,README.md:37,output/README.md:8-21
Vulnerability Type: Dependency confusion or typosquatting through an incorrectnpxpackage command
Risk Level: MediumVulnerable Code
python ## Preview ```bash npx slidew devExport
bash npx slidew export # PDF npx slidew export --format pptx # PPTX npx slidew export --format html # HTMLtext The same incorrect command is printed directly to the terminal: ```python print(f" cd {result['output_dir']} && npx slidew dev")The project declares and documents
@slidev/clias its intended dependency, but the generated instructions invokeslidewrather thanslidev.Technical Analysis
npxcan resolve a named command or package from the npm registry when an appropriate local executable is unavailable. The project intends users to run the Slidev CLI, whose executable isslidev, but repeatedly directs them to runnpx slidew.This typo creates an unsafe package-resolution boundary. Instead of invoking the reviewed Slidev dependency, the command can cause npm to locate, download, and execute a different package associated with the misspelled name. Package installation lifecycle scripts and the package CLI run with the privileges of the invoking user.
The vulnerable command is embedded in every generated output README and printed after successful conversion, making it part of the normal workflow rather than an isolated documentation typo. The audit did not establish that a particular
slidewpackage is malicious; the confirmed weakness is that the project instructs users to resolve and execute an unintended, unpinned registry package.Attack Path
- A user runs
scripts/md_to_ppt.pyto generate a presentation. - The script creates an ...[truncated 1326 chars]
- A user runs
- Remediation
View remediation
Remediation Suggestions
-
Replace every occurrence of
npx slidewwith the correctnpx slidevcommand in:scripts/md_to_ppt.pyREADME.mdoutput/README.md- Any generated templates or terminal messages.
-
Declare
@slidev/clias a local, version-pinned project dependency rather than relying on dynamic registry resolution:bash npm install --save-dev @slidev/cli@<reviewed-version> -
Commit a lockfile and use a reproducible installation command such as:
bash npm ci -
Prevent
npxfrom downloading missing packages at runtime:bash npx --no-install slidev dev npx --no-install slidev exportAlternatively, expose reviewed package scripts through
package.jsonand run them withnpm run. -
Add automated tests that inspect generated README content and terminal guidance to ensure the executable is exactly
slidev. -
Add dependency review, lockfile integrity checks, and registry restrictions to CI so misspelled or undeclared npm packages cannot silently enter the workflow.
-