T08 · Insecure Dependencies
Error
- Location
- SKILL.md:20
- Finding
- Unpinned Third-Party npm Package Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 20-26 **Vulnerability Type**: Supply-chain exposure through unpinned package execution **Risk Level**: High **Vulnerable Code Snippet**: ```markdown ## Installation If `ambit` is not already installed, run it directly via Nix: ```bash npx @cardelli/ambit ``` ``` ### Technical Analysis The installation instructions use `npx` to retrieve and immediately execute `@cardelli/ambit` without specifying an exact version, integrity digest, or verified source revision. Despite the surrounding text saying that it runs through Nix, the documented command invokes an npm package. Because package resolution is not pinned, the effective executable can change after the Skill has been reviewed. Execution therefore depends on the continuing security of the npm publisher account, package registry, release process, and all transitive dependencies. The package scope also differs from the author recorded in the Skill metadata, while the document does not establish or verify the relationship between them. This finding does not prove that the current package is malicious. It establishes that following the documented command places execution trust in mutable, externally hosted code. ### Attack Path 1. An attacker compromises the npm publisher account, release pipeline, package, or one of its dependencies. 2. The attacker publishes a malicious version under the same package name. 3. A user follows the Skill's installation instructions and runs `npx @cardelli/ambit`. 4. `npx` resolves and downloads the current package version. 5. Malicious lifecycle logic or CLI code executes with the permissions of the invoking user. 6. The payload can inspect local files and environment variables, access authenticated CLI state, or issue commands using the user's available Fly.io and Tailscale credentials. ### Impact Assessment Successful exploitation permits arbitrary code execution ...[truncated 359 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to an exact, reviewed package version rather than allowing npm to select the current release. 2. Publish and document the authoritative source repository and its relationship to the `@cardelli` npm scope. 3. Provide verifiable package provenance, signatures, lockfiles, and integrity hashes. 4. Recommend reviewing the resolved package and dependency tree before execution. 5. Disable package lifecycle scripts where operationally compatible. 6. Execute installation and initial validation in a restricted environment without unrelated credentials or access to sensitive files. 7. Use short-lived, narrowly scoped Fly.io and Tailscale credentials when operating the CLI.