T08 · Insecure Dependencies
Warning
- Location
references/backend-plan.md:50- Finding
Unpinned Third-Party JavaScript Loaded from a Remote CDN
- Content
View full analysis
``` ### Technical Analysis The backend plan instructs the application to load the Supabase JavaScript client directly from jsDelivr using the mutable major-version selector `@2`. It does not pin an exact package version and does not specify a Subresource Integrity hash. Consequently, the JavaScript executed by visitors may change after the skill and application have been reviewed. If a compromised package release is published under the selected major version, or if the package distribution or CDN delivery chain is compromised, attacker-controlled JavaScript could execute in the application's browser origin. This is classified as `T08: Insecure Dependencies` because the risk originates from consuming a third-party executable component through an insufficiently constrained supply-chain source. The project only contains a backend plan, so the vulnerable dependency loading is proposed rather than demonstrated as deployed. ### Attack Path 1. The proposed script tag is added to the FuelWatch frontend. 2. The application requests the current `@supabase/supabase-js@2` artifact from jsDelivr whenever a user loads the page. 3. An attacker compromises the upstream package, a qualifying release, or the CDN delivery chain. 4. The mutable CDN URL begins serving attacker-controlled JavaScript without any corresponding change to the audited project. 5. Because no integrity hash is present, the browser accepts and executes the altered script. 6. The malicious script operates in the FuelWatch page context and can inspect application state, read browser-accessible credentials or tokens, alter displayed fuel reports, intercept form submissions, and make authenticated API requ ...[truncated 600 chars]- Remediation
View remediation
``` 3. Prefer bundling or self-hosting a verified dependency artifact so deployments are reproducible. 4. Commit and review dependency lock files if a package manager and build process are introduced. 5. Configure a restrictive Content Security Policy that permits scripts only from explicitly approved sources and avoids `unsafe-inline` and `unsafe-eval`. 6. Use automated dependency monitoring and promptly review security advisories before upgrading the pinned version. ]]>