T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:29
- Finding
- Unpinned npm Packages Permit Mutable Third-Party Code Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 29-41 **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```markdown - **Scaffolding**: `npm create crxjs@latest` (always use `@latest`) ## Quick start ```bash # Scaffold new project (picks framework interactively) npm create crxjs@latest # Or add to existing Vite project npm install @crxjs/vite-plugin -D ``` ``` ### Technical Analysis The Skill directs users to retrieve the CRXJS scaffolding package through the mutable `@latest` tag and explicitly instructs them to always use that tag. It also installs `@crxjs/vite-plugin` without specifying an exact reviewed version. `npm create crxjs@latest` downloads and executes the package version to which the registry's `latest` tag points at invocation time. Consequently, the effective code executed by this instruction can change after the Skill has been audited. The unpinned `npm install` command similarly resolves a mutable package version and may execute dependency lifecycle scripts during installation. This behavior introduces supply-chain risk because a compromised npm account, malicious release, registry incident, or compromised transitive dependency could cause users to retrieve and execute code that was not present during this audit. No evidence establishes that the current CRXJS package is malicious; the vulnerability is the unsafe reliance on mutable, unreviewed package versions. ### Attack Path 1. An attacker compromises the npm publishing credentials, release process, or dependency chain associated with `crxjs` or `@crxjs/vite-plugin`. 2. The attacker publishes a malicious release and causes it to be selected by the `latest` tag or the dependency range resolved by npm. 3. A user follows the Skill and runs `npm create crxjs@latest` or `npm install @crxjs/vite-plugin -D`. 4. npm downloads the attacker-controlled release. 5. The sca ...[truncated 1106 chars]
- Remediation
- ## Remediation Suggestions 1. Replace mutable tags and implicit version resolution with exact, reviewed versions: ```bash npm create crxjs@2.4.0 npm install --save-dev --save-exact @crxjs/vite-plugin@2.4.0 ``` The selected version should be independently verified against the package's actual published releases before use. 2. Remove the instruction to “always use `@latest`.” Recommend deliberate version upgrades only after reviewing release notes, provenance, package contents, and security advisories. 3. Commit `package-lock.json` and use `npm ci` in automated or reproducible environments so dependency resolution follows the reviewed lockfile. 4. Verify package provenance, publisher identity, integrity metadata, and registry source before installation. Configure npm to use an approved registry and consider organizational package allowlists. 5. Review package and transitive dependency lifecycle scripts before execution. Where operationally compatible, install with `--ignore-scripts` and explicitly run only reviewed setup operations afterward. 6. Perform dependency installation in a sandbox or restricted development container without production credentials, sensitive environment variables, or unnecessary filesystem access. 7. Add automated dependency scanning and lockfile review to detect unexpected package, integrity, lifecycle-script, and transitive dependency changes.