T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned Global Third-Party Dependency Installation< | CrunchDAO protocol CLI (coordinators, competitions, staking) | **Agent rules for package installation:** - **Only install `@crunchdao/crunch-cli`** from the official npm registry - **No custom registry URLs** — no `--registry` overrides - **Ask the user before installing** if not already present ``` From `references/cli-reference.md:8-11`: ```markdown ## Installation ```bash npm install -g @crunchdao/crunch-cli ``` ``` From `references/cli-reference.md:405-408`: ```markdown ### Model & Simulation Commands > **Note:** Requires Python `crunch-cli` package (`pip install crunch-cli`) ``` ### Technical Analysis The documented installation commands do not pin dependencies to exact, reviewed versions. Both npm and pip therefore resolve a mutable package version at installation time. The npm dependency is installed globally. npm installation can execute package lifecycle scripts with the permissions of the user running npm, while a global installation makes the resulting executable available broadly in that user's environment. An upstream package compromise, malicious future release, or registry account takeover could consequently introduce executable code after this Skill has already been reviewed. The Python package instruction creates an additional unpinned dependency path. It also conflicts with the Skill's stated policy that only `@crunchdao/crunch-cli` should be installed. The documentation does not establish that the npm and Python packages have the same maintainer, provenance, implementation, ...[truncated 1909 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an exact, reviewed version, for example: ```bash npm install -g @crunchdao/crunch-cli@1.1.6 ``` The pinned version should be updated only after a security review. 2. Prefer a project-local installation over a global installation: ```bash npm install --save-exact @crunchdao/crunch-cli@1.1.6 npx crunch-cli --version ``` 3. Commit and verify a lockfile when the surrounding distribution model permits it. Use npm integrity metadata and provenance verification where available. 4. Document the expected package publisher, repository, version, checksums, and provenance so that installation can fail closed when any attribute differs. 5. Reconcile the Python package instruction with the npm-only installation policy. Remove it unless its publisher and necessity have been independently verified. 6. If the Python package is required, pin an exact version and hash, preferably through a requirements file using hash checking: ```text crunch-cli==<reviewed-version> --hash=sha256:<reviewed-hash> ``` 7. Continue requiring explicit user authorization before installation, and show the exact package name, version, registry, and installation scope in the confirmation prompt. 8. Do not recommend `sudo`, administrator execution, or any other privilege elevation for package installation. ]]>