T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Unpinned Third-Party CLI Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, line 27 **Vulnerability Type**: Supply-chain exposure caused by unpinned package execution **Risk Level**: Medium ### Vulnerable Code ```sh npx @better-auth/cli migrate ``` ### Technical Analysis The skill directs users to execute `@better-auth/cli` through `npx` without specifying an exact, reviewed package version. If the package is absent locally, `npx` can retrieve a current version from the configured package registry and immediately execute its lifecycle or CLI code. Because the retrieved artifact is not constrained by an explicit version in this instruction, its effective implementation can change after the skill has been reviewed. A compromised package release, maintainer account, registry, or package-resolution configuration could therefore cause unreviewed code to execute with the developer's privileges. The requested CLI operation also performs database migrations, meaning it may receive credentials capable of modifying application schema or data. This finding identifies supply-chain risk in the documented command; it does not establish that the named package is currently malicious. ### Attack Path 1. An attacker compromises the package's release channel, maintainer credentials, registry distribution path, or the victim's package-resolution configuration. 2. The attacker publishes or redirects resolution to a malicious version of `@better-auth/cli`. 3. A developer follows the skill and runs `npx @better-auth/cli migrate`. 4. `npx` downloads the unresolved current package version when no trusted local version controls resolution. 5. Malicious package lifecycle or CLI code executes with the developer or CI runner's operating-system privileges. 6. If migration credentials are available, the payload can also access or alter the application's database within those credentials' permissions. ### Impact Assessment Successful exploitation could permit arbi ...[truncated 487 chars]
- Remediation
- ## Remediation Suggestions 1. Add the CLI as a development dependency using an exact, reviewed version rather than resolving an unspecified current release: ```sh npm install --save-dev --save-exact @better-auth/cli@<reviewed-version> ``` 2. Commit and enforce the package lockfile, and use a deterministic installation command such as `npm ci` in CI. 3. Invoke the lockfile-resolved local binary and prevent `npx` from downloading missing packages: ```sh npx --no-install @better-auth/cli migrate ``` 4. Review package provenance, integrity metadata, release history, lifecycle scripts, and migration output before upgrading. 5. Run migrations first in a controlled staging environment and maintain a tested database backup and rollback procedure. 6. Use a dedicated, least-privileged migration account, and avoid exposing unrelated production or deployment secrets to the migration process. 7. Restrict CI network egress and protect the package registry configuration to reduce registry-redirection and dependency-confusion risks.