T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned Global Installation and Execution of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 13-17 **Vulnerability Type**: Unpinned third-party dependency installed globally and immediately executed **Risk Level**: Medium ```bash **Via npm:** ```bash npm install -g @reghoul/pm-dashboard pm-dashboard init pm-dashboard start ``` ``` ### Technical Analysis The installation instructions retrieve the currently published version of `@reghoul/pm-dashboard` without specifying an exact version or verifying its integrity or provenance. The package is installed globally and its commands are then immediately executed. npm packages can run installation lifecycle scripts, while the subsequent `init` and `start` commands execute package-controlled code directly. Because the package implementation is not included in the audited project, its filesystem operations, network communications, server configuration, and treatment of project-state data cannot be independently reviewed from this artifact. The same supply-chain exposure also applies to the unpinned update command documented at `SKILL.md`, lines 44-48: ```bash **Via npm:** ```bash npm update -g @reghoul/pm-dashboard ``` ``` This finding does not establish that the referenced package is malicious. It identifies an unsafe dependency acquisition and execution pattern that permits an unreviewed or compromised future release to become the effective executable payload. ### Attack Path 1. An attacker compromises the package publisher account, registry release process, or another relevant supply-chain component. 2. The attacker publishes a malicious release under the expected package name. 3. A user follows the documented command without an exact version constraint. 4. npm resolves and globally installs the attacker-controlled release. 5. Malicious lifecycle code may execute during installation, or malicious runtime code executes when the user invokes `pm-dashboard init` or `pm-dashboard start`. ...[truncated 841 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a specific, reviewed version rather than resolving the latest release: ```bash npm install --global @reghoul/pm-dashboard@<reviewed-version> ``` 2. Document the expected package provenance, publisher identity, source repository, and release verification process. 3. Verify registry integrity metadata or signed release provenance before installation. 4. Prefer a project-local or isolated installation over a global installation, and execute it through a controlled package script or sandbox. 5. Review npm lifecycle scripts before installation and disable them with `--ignore-scripts` where compatible with the package. 6. Run the dashboard under a dedicated, least-privileged account or container with narrowly scoped filesystem and network access. 7. Replace unrestricted update instructions with a controlled process that pins, reviews, tests, and approves each new version before deployment. 8. Include the dashboard implementation or a verifiable source reference in the audited artifact so its server exposure, state handling, and network behavior can be assessed.