T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:121
- Finding
- Unpinned Global npm Package Installation Creates Supply-Chain Code Execution Risk## Vulnerability Details **File Location**: `SKILL.md:5`, `SKILL.md:12`, `SKILL.md:121-125`, and `references/mcp-setup.md:3-8` **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium The documentation repeatedly directs users to install the latest available version of `@tobilu/qmd` globally rather than an exact, reviewed version. Complete relevant code from `SKILL.md`: ```yaml compatibility: Requires qmd CLI or MCP server. Install via `npm install -g @tobilu/qmd`. ``` ```markdown ## Status !`qmd status 2>/dev/null || echo "Not installed: npm install -g @tobilu/qmd"` ``` ```markdown ## Setup ```bash npm install -g @tobilu/qmd qmd collection add ~/notes --name notes qmd embed ``` ``` Complete relevant code from `references/mcp-setup.md`: ```markdown ## Install ```bash npm install -g @tobilu/qmd qmd collection add ~/path/to/markdown --name myknowledge qmd embed ``` ``` ### Technical Analysis The npm command does not specify an exact package version or verify package integrity. It consequently resolves whatever version is associated with the package's current distribution tag at installation time. The effective dependency may therefore change after this Skill has been reviewed. npm packages can contain lifecycle scripts and executable files. If the package, its publishing account, or a transitive dependency is compromised, installation can execute attacker-controlled code with the privileges of the user invoking npm. Global installation also places the package's executables and supporting files into shared user- or system-level npm locations, increasing the potential scope compared with an isolated project-local dependency. This finding does not establish that the current `@tobilu/qmd` package is malicious. The vulnerability is the unsafe, unpinned installation workflow and its exposure to future supply-chain compromise. ### Attack Path 1. ...[truncated 1656 chars]
- Remediation
- ## Remediation Suggestions 1. Pin QMD to an exact version that has been reviewed: ```bash npm install -g @tobilu/qmd@2.0.0 ``` Confirm the appropriate reviewed package version independently; the Skill metadata version does not necessarily prove the dependency version. 2. Prefer a project-local installation rather than a global installation: ```bash npm install --save-exact @tobilu/qmd@2.0.0 ``` Invoke the local binary through a controlled package script or explicit local path. 3. Commit and enforce a lockfile when using a project-local dependency. Use reproducible installation commands such as `npm ci` so transitive dependencies cannot change silently. 4. Verify package provenance and integrity before installation. Record the expected npm registry source and package integrity digest, and review package ownership, publication history, included files, and lifecycle scripts. 5. Disable lifecycle scripts where QMD supports installation without them: ```bash npm install --ignore-scripts --save-exact @tobilu/qmd@2.0.0 ``` If lifecycle scripts are required, document and review them before permitting execution. 6. Do not run the installation with `sudo`, as an administrator, or from another elevated shell. Use a dedicated, minimally privileged account where practical. 7. Update every installation reference in both `SKILL.md` and `references/mcp-setup.md` so users are not directed to fall back to the unsafe unpinned command.