T08 · Insecure Dependencies
Warning
- Location
install.sh:36- Finding
Unpinned Memvid Package Is Installed Globally and Processes Sensitive Records
- Content
View full analysis
/dev/null; then echo "" echo "⚠️ Memvid CLI not found." echo " This requires: npm install -g memvid" read -p "Install Memvid CLI now? (requires sudo for global install) (y/N) " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then npm install -g memvid || { echo "❌ Failed to install Memvid CLI. Install manually:" echo " npm install -g memvid" exit 1 } echo "✓ Memvid CLI installed" else echo "⚠️ Memvid CLI required. Install manually before using skill." fi ``` The installed executable is subsequently trusted to process sensitive records: ```python _MEMVID_PATHS = [ "/usr/local/bin/memvid", "/usr/bin/memvid", os.path.expanduser("~/.npm-global/bin/memvid"), os.path.expanduser("~/.local/bin/memvid"), ] _DEFAULT_MEMVID = next((p for p in _MEMVID_PATHS if os.path.exists(p)), "memvid") MEMVID_BIN = os.environ.get("MEMVID_BIN", _DEFAULT_MEMVID) ``` ```python result = subprocess.run( cmd, capture_output=True, text=True, timeout=30 ) ``` ### Technical Analysis The installer executes `npm install -g memvid` without an exact version, package-lock file, or integrity verification. It therefore installs whichever release the registry resolves at installation time. The effective dependency can change after this Skill has been reviewed. Global npm installation also expands the potential impact beyond the project directory. Depending on the npm configuration, users may run this command with elevated privileges, which the installer explicitly anticipates by stating that sudo may be required. This depe ...[truncated 2017 chars]- Remediation
View remediation
``` 2. Install it project-locally rather than globally and invoke the binary from a controlled project path. 3. Commit a lockfile and use `npm ci` so dependency resolution is reproducible. 4. Verify package integrity against a trusted, published digest or signed release before installation. 5. Do not recommend sudo for npm installation. Configure a user-owned installation directory if a global CLI is unavoidable. 6. Review the package's transitive dependencies and npm lifecycle scripts before release. 7. Restrict the environment inherited by the Memvid subprocess to only the variables it requires. 8. Verify the executable's ownership, permissions, canonical path, and expected version before invoking it. 9. Update CI to install the same exact audited version used in production rather than the latest release. ]]>