T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:9
- Finding
- Unpinned Global npm Dependency May Execute Unreviewed Code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:9-11` and `SKILL.md:31-38` **Vulnerability Type**: Unpinned third-party package installed globally with npm lifecycle-script execution **Risk Level**: Medium ### Vulnerable Code ```json "requires": { "bins": ["bimdown"], "install": { "npm": "bimdown-cli" } } ``` ```markdown 1. **First check**: Run `which bimdown` or `bimdown --version`. If it already exists, skip installation. 2. **If missing**: Install through npm—but **explicit user permission must be requested first** before independently running `npm install -g`. This writes to the global npm directory and executes arbitrary package scripts, making it a privileged operation. ```bash npm install -g bimdown-cli ``` ``` ### Technical Analysis The Skill directs the agent to install `bimdown-cli` without an exact version or cryptographic integrity constraint. As a result, npm resolves whichever package version the configured registry currently serves. The dependency can therefore change after the Skill has been reviewed. The global `-g` installation also writes outside the project workspace and may execute npm lifecycle scripts such as `preinstall`, `install`, and `postinstall` with the installing user's privileges. Although the Skill correctly requires explicit user permission and warns about package-script execution, consent does not prevent a compromised publisher account, registry compromise, malicious future release, or unexpected dependency change from introducing executable code. No evidence establishes that the current `bimdown-cli` package is malicious. The risk arises from the unpinned and globally executed supply-chain dependency. ### Attack Path 1. An attacker compromises the npm publisher account, the configured package registry, or a transitive dependency used by `bimdown-cli`. 2. The attacker publishes a malicious version under the expected package name. 3. A system without the `bimdown` executable loads the Skill. 4. T ...[truncated 933 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `bimdown-cli` to an explicitly reviewed version rather than resolving the latest release: ```bash npm install --save-exact bimdown-cli@<reviewed-version> ``` 2. Prefer a project-local installation over `npm install -g`, and invoke it through a controlled local path or `npm exec` with an exact version. 3. Commit and enforce a lockfile containing resolved versions and integrity hashes. 4. Verify the expected npm registry, package publisher, package signature or provenance, and artifact checksum before installation. 5. Review both the direct package and its transitive dependencies whenever the pinned version is updated. 6. Disable lifecycle scripts with `--ignore-scripts` where the CLI does not require them. If scripts are required, inspect them before installation and execute the installation in a restricted environment. 7. Avoid elevated installation. Run dependency setup as an unprivileged account in a sandbox or container with minimal filesystem, credential, and network access. 8. Retain the existing explicit-consent requirement, but disclose the exact version, registry, script-execution behavior, and installation scope in the consent prompt. ]]>