T08 · Insecure Dependencies
Error
- Location
SKILL.md:75- Finding
Unpinned Third-Party Packages Executed Through npx
- Content
View full analysis
/dev/null 2>&1; then echo "✅ Lighthouse CLI available" else echo "Installing Lighthouse CLI..." npm install -D @lhci/cli # OR: use npx (auto-downloads, ~50MB, slower first run) fi ``` ```bash npx lighthouse $URL \ --output=json \ --output-path=./cwv-report.json \ --chrome-flags="--headless --no-sandbox --disable-gpu" \ --only-categories=performance \ --quiet npx @lhci/cli collect \ --url=$URL \ --numberOfRuns=3 \ --settings.onlyCategories=performance ``` ```bash npx @squoosh/cli --webp '{"quality":80}' public/hero-banner-v2.jpg ``` ```bash npx serve -s build -l 3000 & sleep 3 npx lighthouse http://localhost:3000 \ ``` ### Technical Analysis The skill instructs users and CI systems to execute several npm packages through `npx` without specifying reviewed versions or enforcing package integrity. Depending on local npm state, `npx` can retrieve a package from the configured registry and immediately execute its entry point. The `--yes` option suppresses the interactive installation confirmation. The affected packages include `lighthouse`, `@lhci/cli`, `@squoosh/cli`, and `serve`. The fallback `npm install -D @lhci/cli` is also unpinned. Consequently, the effective code executed by these instructions can change after the skill has been reviewed. This does not establish that any named package is malicious. The vulnerability is the unsafe dependency-resolution and execution pattern, which leaves the workflow exposed to compromised releases, registry compromise, malicious registry configuration, or other supply-chain attacks. ### Attack Path 1. An attacker compromises a referenced package re ...[truncated 1112 chars]- Remediation
View remediation