T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:18
- Finding
- Unpinned Global Installation of a Third-Party CLI## Vulnerability Details **File Location**: `SKILL.md`, line 18 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code**: ```bash npm install -g @paperpod/cli ``` A related unsafe update instruction appears at `SKILL.md`, line 83: ```bash npm update -g @paperpod/cli ``` ### Technical Analysis The installation command does not pin `@paperpod/cli` to a reviewed version or verify its integrity. It therefore installs whichever package version the npm registry resolves at execution time. The update instruction similarly permits future, unaudited package content to replace the installed CLI. npm packages can define lifecycle scripts that execute during installation with the permissions of the invoking user. Consequently, compromise of the package, its publisher account, or its distribution channel could convert this documented installation step into arbitrary local code execution. Global installation increases exposure because it modifies the user's shared npm environment and makes the CLI available system-wide within that user's installation scope. The audited project does not itself contain a malicious payload, and no compromise of the named package was established. The issue is the mutable and unverified dependency acquisition process. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or another relevant supply-chain component. 2. The attacker publishes a malicious release under the expected package name. 3. A user follows the documented `npm install -g @paperpod/cli` or `npm update -g @paperpod/cli` instruction. 4. npm resolves and downloads the attacker-controlled release because no reviewed version or integrity value is specified. 5. Malicious package code or lifecycle scripts execute locally with the invoking user's permissions. 6. The attacker can access or modify resources available to that user and can alter the globally installed CLI. ### Impact Assessment Successful exploi ...[truncated 482 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to a specific, reviewed version, for example: ```bash npm install -g @paperpod/cli@2.0.3 ``` 2. Verify the selected release and document its expected registry source and integrity digest. 3. Avoid instructing users to run an unrestricted `npm update -g`; instead, specify an explicitly reviewed target version. 4. Prefer a project-local dependency with a committed lockfile over a global installation where operationally feasible. 5. Publish and verify signed release artifacts or package provenance. 6. Review required npm lifecycle scripts and use `--ignore-scripts` when installation scripts are unnecessary. 7. Document a controlled upgrade process that requires security review before changing the pinned version.