T08 · Insecure Dependencies
Error
- Location
- README.md:17
- Finding
- Package Identity Mismatch Enables Dependency Confusion<![CDATA[ ## Vulnerability Details **File Location**: `README.md:17`, `README.md:29`, `README.md:36`; `package.json:2`, `package.json:5-9` **Vulnerability Type**: Dependency confusion caused by inconsistent npm package identities **Risk Level**: High ### Vulnerable Code Snippets `README.md:16-18`: ```bash ## Installation ```bash npm install flexible-data-importer ``` ``` `README.md:28-30`: ```bash Run the importer: ```bash npx data-importer ./path/to/my-data.csv ``` ``` `README.md:34-38`: ```typescript import { UniversalImporter, NodeFileAdapter, OpenAILLMAdapter, SupabaseAdapter } from 'flexible-data-importer'; const importer = new UniversalImporter( new NodeFileAdapter(), ``` `package.json:1-9`: ```json { "name": "@sschepis/flexible-data-importer", "version": "1.0.0", "description": "AI-driven data ingestion for CSV, JSON, XLSX with auto-schema generation and Supabase integration.", "main": "dist/index.js", "types": "dist/index.d.ts", "type": "module", "bin": { "data-importer": "dist/cli.js" ``` ### Technical Analysis The package declared by `package.json` is the scoped npm package `@sschepis/flexible-data-importer`, while the README directs users to install and import the different, unscoped package `flexible-data-importer`. npm treats scoped and unscoped names as separate package identities. Consequently, users following the documented installation command do not necessarily install the package represented by this repository. An attacker who controls, compromises, or publishes the unscoped package can supply arbitrary JavaScript, lifecycle scripts, or a malicious CLI implementation. The documented `npx data-importer` command compounds the risk because `npx` may locate or download a package that provides the requested executable when it is not already installed locally. Users may therefore execute an unintended package rather than the reviewed scoped package. The repository also lacks the declared `dist/index.js`, `dist/ind ...[truncated 2119 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace every unscoped package reference with the exact manifest identity: - Installation: `npm install @sschepis/flexible-data-importer` - Import: `import { ... } from '@sschepis/flexible-data-importer'` 2. Document CLI execution using the verified scoped package and an explicitly pinned version. Avoid commands that permit implicit retrieval of an unrelated package. 3. Prefer installation from a reviewed lockfile followed by execution through a local npm script or `./node_modules/.bin/data-importer`. 4. Publish the declared `dist/index.js`, `dist/index.d.ts`, and `dist/cli.js` artifacts, or include the corresponding source code and reproducible build configuration in the audited repository. 5. Add automated release checks that compare package names in `README.md`, examples, import statements, lockfiles, and `package.json`. 6. Pin security-sensitive production dependencies to reviewed versions and preserve npm integrity hashes through the lockfile. 7. Test package contents with `npm pack --dry-run` before publishing to verify that all declared entry points are present. 8. Instruct users to provide least-privilege Supabase credentials rather than a service-role key wherever possible. Keep credentials outside source files and rotate any credential exposed to an unintended package. 9. Consider reserving or formally deprecating the confusing unscoped npm name, if organizationally possible, to reduce future impersonation risk. ]]>