T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:559
- Finding
- Unpinned npm Dependencies and Registry-Resolved npx Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 559-560, 570, 592, 597, and 640-643 **Vulnerability Type**: Supply-chain exposure through unpinned package installation and execution **Risk Level**: Medium ### Vulnerable Code ```bash npm uninstall moment npm install date-fns ``` ```bash # OR install lodash-es: npm install lodash-es ``` ```bash npx bundlesize ``` ```bash npx size-limit ``` ```bash npm install --save-dev webpack-bundle-analyzer # Generate report npx webpack-bundle-analyzer stats.json dist/ --no-open --report report.html ``` ### Technical Analysis The Skill recommends installing npm packages without exact version constraints or documented integrity controls. It also invokes `bundlesize` and `size-limit` directly through `npx`. When an explicitly pinned local dependency is unavailable, `npx` can resolve and download a package from the configured npm registry before executing its binary. Consequently, the code executed by these instructions is not fixed at Skill review time and may change as new package releases are published. npm package installation may also execute package lifecycle scripts. A compromised package release, maintainer account, registry response, or transitive dependency could therefore introduce arbitrary code into the installation or execution process. No package referenced by the Skill was demonstrated to be malicious. The vulnerability is the unsafe, mutable dependency execution pattern rather than evidence of an active malicious payload. ### Attack Path 1. An attacker compromises a referenced package, one of its transitive dependencies, its maintainer account, or the registry path used by the environment. 2. The attacker publishes or serves a malicious package version. 3. A developer or CI pipeline follows the Skill's instructions and runs an unversioned `npm install` or `npx` command. 4. npm resolves the mutable package version from the r ...[truncated 920 chars]
- Remediation
- ## Remediation Suggestions 1. Add required tools to the project's `devDependencies` using reviewed, exact versions rather than resolving the latest available releases at execution time: ```bash npm install --save-dev --save-exact bundlesize@VERSION size-limit@VERSION webpack-bundle-analyzer@VERSION ``` 2. Pin optimization dependencies such as `date-fns` and `lodash-es` to reviewed versions where the instructions are intended for reproducible automation. 3. Commit `package-lock.json` and use: ```bash npm ci ``` in CI to enforce lockfile-resolved versions and integrity hashes. 4. Prevent `npx` from downloading missing packages: ```bash npx --no-install bundlesize npx --no-install size-limit npx --no-install webpack-bundle-analyzer stats.json dist/ --no-open --report report.html ``` 5. Prefer package scripts that execute lockfile-managed local binaries: ```json { "scripts": { "check:bundle": "bundlesize", "analyze:bundle": "webpack-bundle-analyzer stats.json dist/ --no-open --report report.html" } } ``` 6. Review dependency changes and lockfile diffs, enable automated vulnerability monitoring, and restrict CI secrets and workflow-token permissions according to least privilege. 7. Where compatible with the required packages, disable unnecessary lifecycle scripts during installation or explicitly review packages that require them.