T08 · Insecure Dependencies
- Location
scripts/convert_charts.sh:34- Finding
Unpinned npm Dependency Is Automatically Downloaded and Executed
- Content
View full analysis
Vulnerability Details
File Location:
scripts/convert_charts.sh:34-39
Additional Locations:SKILL.md:160,SKILL.md:164,SKILL.md:296,SKILL.md:333
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: MediumVulnerable Code
bash if npx -y @mermaid-js/mermaid-cli \ -i "$mmd_file" \ -o "$output_file" \ -b "$BACKGROUND" \ -w "$WIDTH" \ 2>/dev/null; thenThe documentation also repeatedly recommends the same unsafe installation and execution pattern:
bash npx -y @mermaid-js/mermaid-cli -i chart.mmd -o chart.png -b transparent -w 1200Technical Analysis
The conversion script invokes
npxwith-y, allowing npm to download and execute@mermaid-js/mermaid-cliwithout interactive confirmation. The command does not pin an exact package version and the project contains no reviewed lockfile or integrity metadata governing the downloaded package and its transitive dependencies.Although
SKILL.mddescribes the dependency as^11.0.0, that range is not enforced by the executable command and would not constitute an immutable pin in any case. Consequently, the code that executes during a future Skill run can differ from the code reviewed during this audit. npm lifecycle scripts and the downloaded CLI execute with the privileges of the account running the Agent.This is a supply-chain exposure rather than evidence that the current Mermaid package is malicious.
Attack Path
- An attacker compromises the npm publisher account, a transitive dependency, the configured npm registry, or the package delivery path.
- The attacker publishes or serves a malicious version of
@mermaid-js/mermaid-clior one of its dependencies. - A user invokes the chart-conversion workflow.
npx -yresolves and downloads the uncontrolled package release without prompting the user.- npm lifecycle logic or the downloaded CLI executes the attacker's code under the Agent user's identity.
...[truncated 689 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin
@mermaid-js/mermaid-clito an exact, reviewed version rather than resolving the latest available release. - Add and commit a package manifest and lockfile containing integrity hashes for all transitive dependencies.
- Install dependencies in a separate, controlled setup phase with
npm ci; do not download packages during report conversion. - Invoke the verified local executable, such as
./node_modules/.bin/mmdc, instead of using runtimenpx -y. - Where compatibility permits, disable lifecycle scripts during installation with
npm ci --ignore-scripts, then explicitly allow only required reviewed setup operations. - Configure npm to use an approved registry and apply package provenance or signature verification where available.
- Run chart conversion in a sandbox with minimal filesystem access, a sanitized environment, no unnecessary credentials, and restricted outbound network access.
- Update every command example in
SKILL.mdso users are not directed to bypass the secured dependency workflow.
- Pin