T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:21
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 21–23 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ```bash npm install orbcafe-ui # or pnpm add orbcafe-ui ``` ### Technical Analysis The installation instructions retrieve `orbcafe-ui` without specifying an exact version or integrity constraint. Consequently, the package manager resolves whichever release is current when the command is executed rather than a version that was reviewed and tested with this skill. npm-compatible package installations may execute lifecycle scripts and install transitive dependencies. If the package, one of its dependencies, or its publishing account is compromised, following these instructions could introduce code that was not present during the audit. No evidence establishes that `orbcafe-ui` is currently malicious; the risk arises from the mutable and unpinned supply-chain dependency. ### Attack Path 1. An attacker compromises the package publisher, a transitive dependency, or the relevant package-distribution channel. 2. The attacker publishes a malicious or otherwise unsafe release under a version accepted by the unpinned installation command. 3. A user follows the documented `npm install orbcafe-ui` or `pnpm add orbcafe-ui` instruction. 4. The package manager resolves and installs the attacker-controlled release. 5. Malicious code may execute through installation lifecycle scripts or later when the application imports and uses the package. ### Impact Assessment Exploitation could execute code with the privileges of the user running the package manager or application. Depending on that environment, the affected scope could include project files, environment variables, developer credentials accessible to the process, build artifacts, and CI/CD resources. The instructions do not request elevated privileges, so this finding does not independently provide administrative or root access.
- Remediation
- ## Remediation Suggestions - Replace the unpinned command with an exact, reviewed package version, such as `npm install --save-exact orbcafe-ui@<reviewed-version>`. - Commit the generated lockfile and require deterministic installation with `npm ci` or the equivalent frozen-lockfile mode for pnpm. - Verify registry provenance and lockfile integrity data before deployment. - Audit the package and its transitive dependency tree for known vulnerabilities and unexpected lifecycle scripts. - In CI/CD environments, disable installation scripts where they are unnecessary, for example with `npm ci --ignore-scripts`, after confirming that the dependency does not legitimately require them. - Use automated dependency updates only when they are accompanied by security scanning, review, and testing.