T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:37
- Finding
- Unpinned Third-Party Packages Are Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 37 and 274 **Vulnerability Type**: Unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code ```bash pnpm dlx @browserbasehq/sdk-functions init my-function ``` ```bash # Or use npx npx @browserbasehq/sdk-functions dev index.ts ``` ### Technical Analysis The skill instructs users to download and immediately execute `@browserbasehq/sdk-functions` without specifying an exact, reviewed version or an integrity constraint. Both `pnpm dlx` and `npx` can resolve the package from a remote registry at execution time. Consequently, the code executed by these commands may differ from the code available when the skill was audited. This creates a supply-chain trust boundary in which a compromised publisher account, malicious future package release, registry compromise, or unexpected dependency change could cause arbitrary package code or lifecycle scripts to execute locally. The risk is especially relevant because the prerequisite instructions export `BROWSERBASE_API_KEY` and `BROWSERBASE_PROJECT_ID` into the environment, while the development command may be run in a project containing a credential-bearing `.env` file. The commands are related to the skill's declared deployment functionality, but dynamically executing an unspecified package version is broader than necessary. An exact reviewed version and lockfile would provide the required functionality with less supply-chain exposure. ### Attack Path 1. An attacker compromises the package publisher, registry entry, or a transitive dependency, or publishes a malicious future release. 2. The user follows the skill and runs the unpinned `pnpm dlx` or `npx` command. 3. The package manager resolves and downloads the attacker-controlled release. 4. The malicious package executes with the permissions of the current local user. 5. It reads accessible environment variables, project files, or `.env` credenti ...[truncated 766 chars]
- Remediation
- ## Remediation Suggestions - Pin `@browserbasehq/sdk-functions` to an exact, reviewed version in every command, rather than using an implicitly resolved latest version. - Install the dependency into the project and commit a lockfile with integrity metadata before running the CLI. - Replace ad hoc `pnpm dlx` and `npx` fallback execution with a package script that invokes the locked local dependency. - Review package provenance, publisher identity, release signatures or attestations, and transitive dependency changes before upgrades. - Run initialization before exporting credentials whenever credentials are not needed for that step. - Execute dependency installation and initialization in a restricted environment without unrelated secrets or sensitive files. - Document an explicit upgrade and review process rather than allowing automatic resolution to future versions. Example hardened workflow: ```bash pnpm add --save-exact @browserbasehq/sdk-functions@REVIEWED_VERSION pnpm exec bb init my-function ``` The exact command should be verified against the reviewed version's official CLI interface, and the resulting lockfile should be retained.