T08 · Insecure Dependencies
Warning
- Location
SKILL.md:116- Finding
Unpinned Third-Party Packages Executed Through npx
- Content
View full analysis
- Remediation
View remediation
add button input form label card npx --yes create-next-app@ my-app --typescript --tailwind --eslint ``` 2. Verify the selected versions against official release records and security advisories before documenting them. 3. Prefer installing dependencies into a controlled project manifest and committing the generated lockfile. Use `npm ci` in automated environments so dependency resolution matches the reviewed lockfile. 4. Enforce a trusted npm registry through project or environment configuration, and use integrity verification where supported. 5. Disable unnecessary package lifecycle scripts during installation when operationally feasible, then explicitly run only reviewed setup steps. 6. Execute package-generation tools in a restricted workspace or container with: - No production credentials. - Minimal filesystem access. - No elevated privileges. - Restricted network access where practical. 7. Review all files created or modified by shadcn/ui and project-generation commands before committing, building, or deploying them. 8. Add an update process that deliberately reviews, tests, and repins newer releases instead of resolving the latest release automatically at execution time. ]]>