T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:266
- Finding
- Unpinned Third-Party Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md:266` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ```bash npx lhci autorun ``` ### Technical Analysis The skill recommends executing `lhci` directly through `npx` without specifying a reviewed version, requiring a lockfile, or restricting execution to an already installed local package. If the package is unavailable locally, `npx` may retrieve and execute it from the configured package registry. Because the package name and version are not securely pinned, the effective executable can change after the skill has been reviewed. The short package name may also resolve to an unintended package rather than the expected Lighthouse CI tooling. This creates exposure to package compromise, package-name confusion, registry compromise, and unexpected upstream changes. ### Attack Path 1. A user or CI agent follows the instruction in `SKILL.md`. 2. The environment does not contain a trusted local executable matching `lhci`. 3. `npx` resolves the unpinned package through the configured package registry. 4. An attacker-controlled, compromised, or unintended package is downloaded. 5. Package lifecycle logic or the package CLI executes with the privileges of the user or CI runner. 6. The malicious code can access resources available to that process, including the source tree, environment variables, build artifacts, and CI credentials. ### Impact Assessment Successful exploitation permits arbitrary code execution with the invoking user's or CI runner's privileges. The accessible scope may include project files, repository credentials, package-registry tokens, deployment credentials, environment secrets, and build outputs. In a privileged CI environment, this could lead to source-code modification, secret theft, poisoned artifacts, or compromise of downstream deployment processes.
- Remediation
- ## Remediation Suggestions 1. Verify the intended Lighthouse CI package and use its official, fully qualified package name. 2. Add a reviewed, exact version as a development dependency and commit the generated lockfile. 3. Run only the locally installed and lockfile-verified executable, for example with `npx --no-install`, rather than allowing on-demand registry retrieval. 4. Configure CI to use lockfile-enforcing installation commands such as `npm ci`. 5. Disable or strictly control dependency lifecycle scripts where operationally feasible. 6. Apply dependency integrity verification, automated vulnerability scanning, and controlled registry policies. 7. Apply the same pinning and local-only execution requirements to the `npx bundlesize` guidance near line 263 if it is used as an executable command.