T08 · Insecure Dependencies
Error
- Location
SKILL.md:15- Finding
Unpinned Third-Party npm Package Is Downloaded and Executed
- Content
View full analysis
``` ### Technical Analysis The skill instructs users and agents to install or immediately execute `@openindex/openindexcli` without specifying a version, integrity hash, lockfile, verified source repository, or trusted publisher identity. An unversioned `npx` invocation can retrieve the package version currently selected by the npm registry and execute it immediately. Similarly, global installation may run npm lifecycle scripts and makes the package available outside the project environment. The effective executable payload can therefore change after this skill has been reviewed. The project contains only `SKILL.md`; it does not include the CLI implementation or dependency metadata. Consequently, the audit cannot validate the package's cryptographic behavior, network communication, private-key handling, or lifecycle scripts. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or the package's dependency chain. 2. The attacker publishes a malicious release selected by the unpinned package reference. 3. A user or agent follows the documentation and runs either: - `npm install -g @openindex/openindexcli`, or - `npx @openindex/openindexcli `. 4. npm downloads and executes attacker-controlled package or lifecycle code with the invoking user's permissions. 5. The malicious code reads accessible environment variables, private keys, messages, credentials, or local files and can transmit them to an attacker-controlled service. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the user running npm or `npx`. The affected scope may include ...[truncated 598 chars]- Remediation
View remediation