T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Unpinned Playwright Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md:12` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium **Vulnerable code:** ```sh npx playwright install chromium ``` ### Technical Analysis The setup documentation directs users to execute Playwright through `npx` without declaring or pinning an exact package version. If Playwright is not already installed locally, `npx` may resolve and execute package code obtained from the configured package registry. The reviewed project provides no dependency manifest, lockfile, integrity metadata, or package provenance policy that would constrain this resolution. Consequently, the code executed during installation may differ between invocations and cannot be tied to the version reviewed with this skill. Registry compromise, a compromised upstream release, malicious registry configuration, or unintended package resolution could cause unreviewed package code to run. The command also initiates the download and installation of a Chromium artifact without a project-level integrity control documented in the repository. ### Attack Path 1. A user follows the prerequisite instructions in `SKILL.md`. 2. The user runs `npx playwright install chromium`. 3. If no trusted local Playwright version is available, `npx` resolves a package through the user's configured registry or cache. 4. A compromised registry, upstream package release, or environment-specific resolution supplies unreviewed package code. 5. `npx` executes the resolved Playwright CLI with the privileges of the invoking user. 6. Malicious package code could access files, environment variables, network resources, and credentials available to that user or alter downloaded browser artifacts. This path is conditional on dependency or registry compromise; no malicious Playwright payload is included in the audited project itself. ### Impact Assessment Exploited package code would execute with t ...[truncated 444 chars]
- Remediation
- ## Remediation Suggestions 1. Add Playwright to a reviewed dependency manifest using an exact version rather than resolving it dynamically. 2. Commit a package-manager lockfile and require frozen or immutable lockfile installation, such as `npm ci`. 3. Replace the setup command with an invocation of the previously installed, locked local dependency. 4. Configure installations to use an approved registry over TLS and apply package provenance or signature verification where supported. 5. Review lockfile changes and dependency updates before release, and use automated software composition analysis to detect compromised or vulnerable versions. 6. Run browser installation under a non-privileged account and avoid exposing unrelated secrets or production credentials in the installation environment. 7. Where operationally feasible, verify downloaded browser artifacts against trusted checksums or obtain them through a controlled internal artifact repository.