T08 · Insecure Dependencies
Error
- Location
SKILL.md:125- Finding
Unpinned Global Third-Party Package Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:125-130
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: HighVulnerable Code
markdown ## Installation ```bash npm install -g camsnap # or from source cargo install camsnaptext ### Technical Analysis The installation instructions retrieve and globally install a mutable package named `camsnap` from either the npm or Cargo public registry. They do not specify an exact version, integrity hash, canonical publisher, source repository, or package signature. The audited project contains neither an npm manifest nor a Cargo manifest that establishes that either registry package corresponds to the reviewed source code. Consequently, the effective code installed by these commands is outside the audited package and can change independently after review. Global npm installation may also execute package lifecycle scripts during installation. A malicious or compromised registry release could therefore execute code immediately rather than waiting for the user to invoke `camsnap`. ### Attack Path 1. A user or Agent follows the installation instructions in `SKILL.md`. 2. The package manager resolves the mutable, unpinned package name from a public registry. 3. An attacker compromises the package publisher, publishes a malicious update, or controls an unrelated package using the expected name. 4. The package manager downloads the attacker-controlled package. 5. Installation hooks or the subsequently installed executable run with the privileges of the installing user. 6. The malicious package can read or modify data accessible to that user, use available credentials, and establish additional persistence. ### Impact Assessment Successful exploitation permits arbitrary code execution with the privileges of the user running npm or Cargo. If installation is performed with elevated privileges, as is sometimes done for gl ...[truncated 250 chars]- Remediation
View remediation
Remediation Suggestions
- Include the actual camera implementation in the reviewed repository instead of delegating installation to an unidentified package.
- Pin an exact dependency version and integrity digest.
- Identify and link the canonical package publisher and source repository.
- Provide a lockfile or equivalent reproducible dependency manifest.
- Avoid global installation where possible; use an isolated environment with least privilege.
- Disable or explicitly review package installation scripts.
- Verify signatures, provenance attestations, and checksums before execution.
- Add automated verification that the published package is built from the audited source revision.