T08 · Insecure Dependencies
Warning
- Location
- EXAMPLES.md:140
- Finding
- Unversioned Third-Party Package Installation Creates Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Locations**: `EXAMPLES.md:140`, `EXAMPLES.md:160`, `EXAMPLES.md:185`, `EXAMPLES.md:221`, `EXAMPLES.md:349-350`, and `EXAMPLES.md:356-357` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash npm install --save-exact express pg jsonwebtoken ``` ```bash npm install --save-exact helmet cors express-rate-limit ``` ```bash npm install --save-dev --save-exact jest supertest ``` ```bash npm install --save-dev --save-exact eslint prettier eslint-config-prettier ``` ```bash npm install --save-dev --save-exact typescript @types/node @types/express npx tsc --init --strict ``` ```bash npm install --save-dev --save-exact husky lint-staged npx husky init ``` ### Technical Analysis The documented commands install packages without explicit reviewed versions. The `--save-exact` option only records the version selected during that installation; it does not constrain which version npm initially resolves and downloads. Consequently, following the instructions at different times can install different package releases. During installation, npm may also execute lifecycle scripts supplied by direct or transitive dependencies. This can occur before the newly generated lock file provides reproducibility. The `npx` commands may additionally download and execute a package when a suitable local executable is unavailable, although the preceding installation normally supplies the expected package. This behavior creates a supply-chain exposure if a named package, one of its transitive dependencies, or the relevant registry distribution channel is compromised. No evidence indicates that any package named in the examples is currently malicious; the vulnerability is the unsafe dependency acquisition practice. ### Attack Path 1. A threat actor compromises a referenced package, a transitive dependency, a maintainer account, or the package publication channel. 2. The attacker pu ...[truncated 1523 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Specify reviewed immutable versions in every installation command, for example: ```bash npm install --save-exact express@<reviewed-version> pg@<reviewed-version> jsonwebtoken@<reviewed-version> ``` 2. Generate and commit `package-lock.json` only after reviewing the resolved dependency tree and package integrity metadata. 3. For repeatable installation, use the committed lock file: ```bash npm ci ``` 4. In CI, use a clean, isolated runner with least-privilege credentials and restrict unnecessary network and filesystem access. 5. Audit direct and transitive dependencies using appropriate vulnerability and provenance checks before adoption. 6. Review packages for lifecycle scripts. Where operationally compatible, consider disabling scripts during initial inspection: ```bash npm ci --ignore-scripts ``` Required lifecycle scripts should then be reviewed and run explicitly. 7. Execute only locally installed command-line tools. Replace unrestricted `npx` usage with a local package script or: ```bash npx --no-install tsc --init --strict npx --no-install husky init ``` 8. Configure an approved registry, retain npm integrity verification, and consider package allowlisting or lock-file integrity enforcement in CI. ]]>