T08 · Insecure Dependencies
Warning
- Location
SKILL.md:71- Finding
Unpinned npm and npx Packages Permit Mutable Third-Party Code Execution
- Content
View full analysis
1. Scaffold with `npm init @capacitor/plugin@latest`. ``` ```bash # SKILL.md:393-396 npx @capawesome/cli login # Create an app npx @capawesome/cli apps:create ``` ```bash # SKILL.md:428 npx @capawesome/cli apps:liveupdates:upload --app-id ``` ```bash # SKILL.md:437-440 npx @capawesome/cli apps:builds:create --app-id --platform android # Download the artifact npx @capawesome/cli apps:builds:download --app-id --build-id ``` ```bash # SKILL.md:449-452 npx @capawesome/cli apps:destinations:create --app-id # Deploy a build npx @capawesome/cli apps:deployments:create --app-id --build-id ``` ```bash # SKILL.md:460-461 npx @capawesome/cli login --token npx @capawesome/cli apps:builds:create --app-id --platform ios --detached ``` ### Technical Analysis The documentation instructs users or agents to fetch and execute npm packages without pinning them to reviewed versions. The `@latest` selector explicitly resolves to mutable code, while `npx @capawesome/cli` may download and execute the package version currently published in the configured npm registry when no suitable local installation exists. Such package execution can include CLI entry points and npm lifecycle behavior with the privileges of the invoking user. The Capawesome CLI is additionally used in contexts where it can access authentication tokens, application identifiers, build artifacts, source or generated application content, and deployment destinations. The network behavior itself is consistent with the optional cloud functionality declared by ...[truncated 2213 chars]- Remediation
View remediation
my-app -- --template react-ts npm init @capacitor/plugin@ ``` 2. Install the Capawesome CLI as a pinned project dependency instead of allowing `npx` to resolve a mutable remote version: ```bash npm install --save-dev --save-exact @capawesome/cli@ ``` 3. Commit `package.json` and the package-manager lockfile, then use deterministic installation in automation: ```bash npm ci npx --no-install @capawesome/cli ``` The `--no-install` option prevents `npx` from silently downloading a missing package. 4. Review version upgrades explicitly. Validate package provenance, release signatures or attestations where available, dependency changes, and lockfile integrity before updating pinned versions. 5. Configure CI to use an approved npm registry, enforce dependency allowlists, and run dependency scanning and integrity verification before execution. 6. Supply Capawesome tokens through protected CI secret variables rather than literal command-line values. Ensure tokens are masked in logs, unavailable to untrusted build steps, and restricted to the minimum required cloud permissions. 7. Use short-lived or regularly rotated tokens and separate credentials by environment. A build-only workflow should not receive deployment or destination-management permissions unless those operations are required. 8. Run package installation and cloud CLI operations in an isolated, non-privileged environment with access only to required project files and secrets. ]]>