T08 · Insecure Dependencies
Warning
- Location
SKILL.md:14- Finding
Unpinned Runtime and Application Dependencies Permit Supply-Chain Code Substitution
- Content
View full analysis
``` ``` ```json "dependencies": { "commander": "^12.1.0", "express": "^4.21.0", "open": "^10.1.0", "xero-node": "^9.3.0" } ``` ### Technical Analysis The documented invocation uses `npx -y bun`, which allows the package manager to download and execute the version of the `bun` package resolved at runtime without interactive confirmation. The runtime version is not pinned. The application dependencies also use caret ranges, and the audited project contains no lockfile. Consequently, a later installation may resolve dependency versions different from those reviewed during this audit. Because npm package lifecycle and runtime code execute with the permissions of the invoking process, a compromised or unexpectedly modified dependency could access the process environment, local files, stored OAuth tokens, and network resources. This does not establish that any currently declared package is malicious. The vulnerability is the lack of reproducible and integrity-constrained dependency resolution. ### Attack Path 1. An attacker compromises a package, maintainer account, registry distribution channel, or newly resolved dependency version. 2. The user or Agent executes the documented `npx -y bun` command. 3. `npx` automatically downloads and executes the runtime package without confirmation, or the package manager installs a newer dependency allowed by a caret range. 4. The malicious package code executes in the CLI process. 5. The code can read `XERO_CLIENT_ID`, `XERO_CLIENT_SECRET`, the OAuth token file, and any files accessible to the current operating-system account. 6. ...[truncated 775 chars]- Remediation
View remediation