T08 · Insecure Dependencies
Warning
- Location
SKILL.md:37- Finding
Unpinned Dependencies Permit Unreviewed Supply-Chain Code Execution
- Content
View full analysis
cd ``` ``` From `SKILL.md:80-83`: ```markdown ```bash # swap @nuxt/ui for @antdv-next/nuxt antdv-next @antdv-next/icons if that's the chosen UI kit pnpm add @nuxt/ui @nuxt/image @nuxtjs/seo @nuxthub/core @vueuse/nuxt pnpm add -D @nuxt/eslint @nuxt/test-utils @vitejs/plugin-vue @vue/test-utils vitest happy-dom ``` ``` From `SKILL.md:113-115`: ```markdown [antdv-next](https://github.com/antdv-next/antdv-next) is Ant Design's Vue 3 component library, with an **official Nuxt module**, `@antdv-next/nuxt` (requires Nuxt ≥ 4.0.0, Vue ≥ 3.5.0): 1. Install: `npx nuxi module add @antdv-next/nuxt` (or manually: `pnpm add -D @antdv-next/nuxt antdv-next @antdv-next/icons` — the upstream docs list all three as devDependencies even though components render at runtime; Nuxt modules commonly work this way). ``` From `references/package.example.json:1-4` and `references/package.example.json:20-22`: ```jsonc // Version numbers below are illustrative only (pins from when this skill was // authored) — always let `pnpm add`/`nuxi init` resolve the actual latest // release rather than typing these ranges in by hand. Don't assume Nuxt is // still on major 4 by the time this skill i ...[truncated 2636 chars]- Remediation
View remediation
init -- pnpm add --save-exact nuxt@ ``` 2. Pin the `packageManager` field to an exact, approved pnpm version instead of deriving it dynamically from an arbitrary local installation. 3. Generate and commit `pnpm-lock.yaml`, then enforce immutable installation in CI: ```bash pnpm install --frozen-lockfile ``` 4. Use `--ignore-scripts` during dependency installation where lifecycle scripts are unnecessary. 5. Permit build scripts only for packages whose scripts and provenance have been reviewed. Keep the native build allowlist as narrow as possible. 6. Enable package-registry provenance verification, integrity checking, dependency scanning, and automated review of lockfile changes. 7. Route dependency upgrades through a controlled update process rather than always selecting `latest`. 8. Run scaffolding and installation in a restricted container or sandbox without production credentials. ]]>