T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:142
- Finding
- Unpinned Third-Party Package Execution and Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 142–143 **Vulnerability Type**: Unpinned npm dependencies and mutable package execution **Risk Level**: Medium ### Vulnerable Code ```bash npx create-video@latest --template blank npm i @remotion/google-fonts ``` ### Technical Analysis The documented setup process instructs users to download and execute the current release of `create-video` through `npx ...@latest`. The `latest` tag is mutable, so the code executed at installation time may differ from the version that existed when this Skill was audited. The subsequent installation of `@remotion/google-fonts` also omits an exact version. No lockfile is included to provide integrity and transitive-dependency resolution guarantees. Depending on npm configuration and package contents, installation may also execute package lifecycle scripts. This creates a supply-chain trust boundary in which future package releases, compromised maintainer accounts, or compromised transitive dependencies could introduce code that was not reviewed with this Skill. ### Attack Path 1. An attacker compromises a relevant npm publisher account, package release process, or transitive dependency. 2. The attacker publishes a malicious version and causes it to be resolved by the mutable `latest` tag or unpinned dependency range. 3. A user follows the setup commands in `SKILL.md`. 4. `npx` downloads and executes the resolved `create-video` package with the user's local permissions, or npm runs malicious package code or lifecycle scripts during installation. 5. The malicious code accesses resources available to the invoking process. This finding does not establish that the currently published packages are malicious; it identifies the unsafe, non-reproducible dependency execution mechanism. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running the setup commands. Depending on that user's environment, the code cou ...[truncated 257 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with a reviewed, exact package version: ```bash npx create-video@X.Y.Z --template blank ``` 2. Pin `@remotion/google-fonts` to an exact reviewed version rather than allowing mutable resolution: ```bash npm install --save-exact @remotion/google-fonts@X.Y.Z ``` 3. Commit and review a generated `package-lock.json`, including resolved package sources and integrity hashes. 4. Use `npm ci` for repeatable installation after the lockfile has been established. 5. Review the dependency tree and package lifecycle scripts before upgrades. Where compatible with the required workflow, install with lifecycle scripts disabled: ```bash npm ci --ignore-scripts ``` 6. Perform package setup in a least-privileged, isolated environment without production credentials or unnecessary filesystem access. 7. Use an approved npm registry and enforce dependency provenance, integrity, and package-version policies in CI.