T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Execution of Unpinned npm Packages Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 13-15 and 119 **Vulnerability Type**: Supply-chain risk from unpinned package execution **Risk Level**: Medium ### Vulnerable Code ```markdown 1. Browser MCP tools are available (Playwright MCP or Chrome MCP, run `npx playwright install chromium` first to ensure browser readiness) 2. Target URL is accessible 3. Project is initialized: `npx create-next-app@latest` + Tailwind + shadcn/ui ``` ```markdown - **Check after each component**: `npx tsc --noEmit` ``` ### Technical Analysis The workflow directs the agent to execute npm package entry points without requiring exact package versions, integrity verification, or installation from an audited lockfile. In particular, `npx create-next-app@latest` explicitly downloads and executes the package version currently associated with the mutable `latest` tag. The `npx playwright` and `npx tsc` commands can also download packages when suitable local executables are unavailable. Their effective behavior therefore depends on the local project state, npm configuration, configured registry, and packages available when the commands are run. npm packages can execute JavaScript through command-line entry points and installation lifecycle scripts. Consequently, a compromised upstream release, malicious registry configuration, dependency-confusion condition, or unexpected package resolution could result in arbitrary local code execution. ### Attack Path 1. An attacker compromises a referenced package, one of its transitive dependencies, or the package registry used by the environment. Alternatively, the attacker influences npm configuration or package resolution. 2. A user or agent follows the Skill instructions in an environment without a trusted, lockfile-controlled local executable. 3. `npx` resolves and downloads the mutable or otherwise unverified package. 4. npm runs package lifecycle scripts or the package's comman ...[truncated 1183 chars]
- Remediation
- ## Remediation Suggestions 1. Replace mutable tags such as `@latest` with explicitly reviewed versions, for example `create-next-app@<exact-version>`. 2. Declare all required tools in `package.json`, commit the generated lockfile, and perform deterministic installation with `npm ci`. 3. Invoke only locally installed executables. Use package scripts or `npx --no-install` so execution fails rather than downloading an unexpected package. 4. Configure npm to use an approved registry and validate the registry configuration before installation. 5. Review lockfile changes and verify package provenance and integrity before upgrading dependencies. 6. Disable unnecessary npm lifecycle scripts where operationally feasible, or perform installation in a restricted sandbox before allowing scripts. 7. Run installation and build commands in an isolated, least-privileged environment without unrelated credentials or access to sensitive host files. 8. Document the exact approved Playwright, TypeScript, and `create-next-app` versions instead of relying on ambient project state or mutable registry resolution.