T08 · Insecure Dependencies
Warning
- Location
- scripts/md_to_ppt.py:631
- Finding
- Typographical Error in npx Command Can Execute an Unintended Registry Package## Vulnerability Details **File Location**: `scripts/md_to_ppt.py:631-645` **Additional Locations**: `scripts/md_to_ppt.py:731`, `README.md:37`, `output/README.md:8-21` **Vulnerability Type**: Dependency confusion or typosquatting through an incorrect `npx` package command **Risk Level**: Medium ### Vulnerable Code ```python ## Preview ```bash npx slidew dev ``` ## Export ```bash npx slidew export # PDF npx slidew export --format pptx # PPTX npx slidew export --format html # HTML ``` ``` The same incorrect command is printed directly to the terminal: ```python print(f" cd {result['output_dir']} && npx slidew dev") ``` The project declares and documents `@slidev/cli` as its intended dependency, but the generated instructions invoke `slidew` rather than `slidev`. ### Technical Analysis `npx` can resolve a named command or package from the npm registry when an appropriate local executable is unavailable. The project intends users to run the Slidev CLI, whose executable is `slidev`, but repeatedly directs them to run `npx slidew`. This typo creates an unsafe package-resolution boundary. Instead of invoking the reviewed Slidev dependency, the command can cause npm to locate, download, and execute a different package associated with the misspelled name. Package installation lifecycle scripts and the package CLI run with the privileges of the invoking user. The vulnerable command is embedded in every generated output README and printed after successful conversion, making it part of the normal workflow rather than an isolated documentation typo. The audit did not establish that a particular `slidew` package is malicious; the confirmed weakness is that the project instructs users to resolve and execute an unintended, unpinned registry package. ### Attack Path 1. A user runs `scripts/md_to_ppt.py` to generate a presentation. 2. The script creates an ...[truncated 1326 chars]
- Remediation
- ## Remediation Suggestions 1. Replace every occurrence of `npx slidew` with the correct `npx slidev` command in: - `scripts/md_to_ppt.py` - `README.md` - `output/README.md` - Any generated templates or terminal messages. 2. Declare `@slidev/cli` as a local, version-pinned project dependency rather than relying on dynamic registry resolution: ```bash npm install --save-dev @slidev/cli@<reviewed-version> ``` 3. Commit a lockfile and use a reproducible installation command such as: ```bash npm ci ``` 4. Prevent `npx` from downloading missing packages at runtime: ```bash npx --no-install slidev dev npx --no-install slidev export ``` Alternatively, expose reviewed package scripts through `package.json` and run them with `npm run`. 5. Add automated tests that inspect generated README content and terminal guidance to ensure the executable is exactly `slidev`. 6. Add dependency review, lockfile integrity checks, and registry restrictions to CI so misspelled or undeclared npm packages cannot silently enter the workflow.