T08 · Insecure Dependencies
Warning
- Location
- README.md:41
- Finding
- Unpinned npm Package and Mutable Runtime Dependency Create a Supply-Chain Execution Risk<![CDATA[ ## Vulnerability Details **File Location**: `README.md:41-44`; `package.json:62-64` **Vulnerability Type**: Unpinned remote package execution and mutable dependency resolution **Risk Level**: Medium ### Vulnerable Code `README.md:41-44`: ```markdown ### npx install (recommended) ```bash npx skill-cybernetic-thinking install ``` ``` `package.json:62-64`: ```json "dependencies": { "@clack/prompts": "^0.9.1" } ``` ### Technical Analysis The recommended `npx` command does not specify an exact package version. If the package is not already present locally, `npx` may retrieve the currently resolved release from the npm registry and immediately execute its installer entry point. Consequently, the code executed by users can differ from the audited version. The `@clack/prompts` dependency also uses the mutable range `^0.9.1`, permitting later compatible releases to be selected during dependency resolution. Although the repository's `package-lock.json` contains official npm registry URLs and integrity hashes, consumers installing a published npm package do not reliably inherit the publisher repository's lockfile resolution. This is not evidence that the current dependencies are malicious. The risk arises because a future compromised package release, maintainer account, or permitted dependency update could alter the effective executable code without corresponding review of this repository snapshot. ### Attack Path 1. An attacker compromises the npm account, publication pipeline, or another release channel for `skill-cybernetic-thinking`, or compromises a dependency version allowed by the declared semver range. 2. The attacker publishes a modified package or dependency containing malicious installer behavior. 3. A user follows the recommended unpinned command: `npx skill-cybernetic-thinking install`. 4. `npx` resolves and downloads the affected release rather than the audited `0.6.0` release. 5. Node.js executes the package installer with the inv ...[truncated 944 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the documented executable package version: ```bash npx skill-cybernetic-thinking@0.6.0 install ``` 2. Pin runtime dependencies to exact reviewed versions: ```json "dependencies": { "@clack/prompts": "0.9.1" } ``` 3. Regenerate and commit `package-lock.json` after updating package metadata. The current lockfile declares project version `0.5.0`, while `package.json` and `SKILL.md` declare `0.6.0`. 4. Use `npm ci` in release and verification workflows so dependency installation fails when the manifest and lockfile disagree. 5. Enable npm publication provenance, multi-factor authentication, protected release workflows, and restricted automation tokens. 6. Review dependency updates explicitly and run supply-chain scanning before publishing each release. 7. Document verification of package integrity, release provenance, or signed source tags for users requiring stronger assurance. ]]>