T08 · Insecure Dependencies
- Location
SKILL.md:417- Finding
Unpinned npm Installation and Implicit Package Retrieval
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 233, 417, and 428-433
Vulnerability Type: Unpinned and globally installed third-party dependencies
Risk Level: MediumVulnerable Code
At line 233, the documentation directs the user to invoke Remotion through
npx:bash npx remotion --versionAt line 417, Remotion is specified using only a minimum version constraint:
markdown | Remotion | npm package | Required | `npm install remotion` | 4.0+ |At lines 428-433, the installation procedure uses an unpinned global installation and subsequently invokes the package through
npx:bash # Install Node.js and Remotion npm install -g remotion npm install # ... # Verify installation node --version npx remotion --version ffmpeg -versionTechnical Analysis
The installation instructions do not pin Remotion to an exact, reviewed version. No
package.json, package lockfile, or dependency integrity metadata is included in the audited project. Consequently, dependency resolution is mutable and cannot be reproduced or independently verified from this artifact.The command
npm install -g remotionretrieves the package and its transitive dependencies from the configured npm registry. npm packages can execute lifecycle scripts during installation, allowing a compromised package or dependency to execute code under the privileges of the invoking user.The
npx remotion --versioncommand introduces an additional retrieval risk. If an appropriate trusted local executable is unavailable,npxmay download and execute a package from the configured registry. The effective executable may therefore differ from what was reviewed when the skill was published.Global installation also expands the exposure beyond the project directory. Depending on npm configuration and the privileges used to run the command, the installed executable may become available to other projects or ...[truncated 1755 chars]
- Remediation
View remediation
Remediation Suggestions
- Add a reviewed
package.jsonand commit a lockfile containing resolved versions and integrity hashes. - Pin Remotion and every direct dependency to an exact version rather than using a minimum version such as
4.0+. - Replace
npm installwithnpm ciso installation fails when dependency metadata differs from the committed lockfile. - Remove
npm install -g remotion; install Remotion locally within the project to limit scope and improve reproducibility. - Invoke the reviewed local executable through a package script or an explicitly pinned command rather than allowing
npxto retrieve an unspecified package. - Where practical, use offline or allowlisted package installation after dependencies have been reviewed and cached.
- Audit package lifecycle scripts and transitive dependencies before release. Consider disabling lifecycle scripts during initial verification with
npm ci --ignore-scripts, then explicitly run only required, reviewed setup steps. - Run installation and rendering under a dedicated, non-administrative account or sandbox with minimal filesystem and network access.
- Add automated dependency scanning and lockfile integrity checks to the release process.
- Add a reviewed