T08 · Insecure Dependencies
- Location
SKILL.md:98- Finding
Unpinned Global Installation of a Third-Party npm Package
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:98
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: MediumVulnerable Code Snippet
bash npm install -g simple-local-memoryThe same unversioned installation instruction is also referenced in the dependency table at
SKILL.md:177.Technical Analysis
The skill directs users to install
simple-local-memoryfrom the npm registry without specifying an exact version, integrity hash, lockfile, or verified source repository. npm will therefore resolve whichever package release is represented by the applicable registry tag at installation time. The installed implementation can change after this skill has been reviewed.npm packages may execute lifecycle scripts during installation. Because the package is installed globally with
-g, such scripts execute with the permissions of the user running npm and can modify globally accessible package or command locations. If a user follows the separate generic recommendation to run with administrator privileges when permission errors occur, the potential impact could be greater, although the installation instruction itself does not explicitly require elevation.This is a supply-chain weakness rather than evidence that the named package is currently malicious. The project provides no package implementation, lockfile, checksum, provenance record, or verification procedure with which to validate the dependency.
Attack Path
- An attacker compromises the npm package, its maintainer account, or its publication pipeline and publishes a malicious release under the version resolved by the unpinned command.
- A user follows the skill documentation and runs
npm install -g simple-local-memory. - npm downloads the mutable package release and may execute its installation lifecycle scripts.
- Malicious package code executes with the installing user's privileges.
- The package co ...[truncated 1001 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin the dependency to an exact reviewed version, for example:
bash npm install --save-exact simple-local-memory@<reviewed-version> - Prefer a project-local dependency over a global installation and invoke its executable through a pinned package script or local
node_modules/.binpath. - Commit and enforce a lockfile with integrity metadata. Use
npm ciin automated or reproducible environments. - Document the authoritative package repository, expected publisher, reviewed version, and package provenance.
- Verify registry signatures, provenance attestations, or independently published checksums where available.
- Review package contents and lifecycle scripts before installation. Where compatible with deployment requirements, install with lifecycle scripts disabled and explicitly run only reviewed setup operations.
- Do not recommend administrator execution as a general response to permission errors. Correct npm ownership or use a user-scoped package location instead.
- Reconcile the documentation's “zero external dependency” claim with its mandatory npm dependency so users can make an informed trust decision.
- Pin the dependency to an exact reviewed version, for example: