T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:61
- Finding
- Unpinned Global Installation of an Unaudited npm Dependency## Vulnerability Details **File Locations**: - `SKILL.md:16-23` - `SKILL.md:61-68` - `references/troubleshooting.md:22-28` **Vulnerability Type**: Unpinned third-party dependency with global installation guidance **Risk Level**: Medium ### Vulnerable Code `SKILL.md:16-23`: ```yaml install: - id: social-flow-cli-node kind: node package: "@vishalgojha/social-flow" bins: - social label: Install Social Flow CLI (npm) ``` `SKILL.md:61-68`: ```markdown - Verify package source: - `https://www.npmjs.com/package/@vishalgojha/social-flow` - `https://github.com/vishalgojha/social-flow` - Suggest install or upgrade (for the human to run): ```bash npm install -g @vishalgojha/social-flow ``` ``` `references/troubleshooting.md:22-28`: ```markdown ### `social` command not found - Install or upgrade: ```bash npm install -g @vishalgojha/social-flow ``` ``` ### Technical Analysis The project instructs users to install `@vishalgojha/social-flow` globally without specifying an exact version or integrity value. The dependency's implementation is not included in the audited artifact, so its installation scripts, transitive dependencies, and runtime behavior cannot be verified by reviewing this project. An unversioned npm installation ordinarily resolves the registry's current matching release. Consequently, the code installed later can differ from the code that was available when this skill was reviewed. npm packages may also define lifecycle scripts that execute during installation. Global installation increases exposure because it places an executable on the user's command path and may run with elevated filesystem privileges on systems where global npm installation requires administrative access. The matching npm scope and GitHub owner reduce obvious typosquatting concerns, and the audit found no evidence that this package is currently malicious. The vulnerability ...[truncated 1859 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version, for example: ```bash npm install -g @vishalgojha/social-flow@X.Y.Z ``` Do not use version ranges or implicit latest-version resolution. 2. Record and verify package provenance before installation: - Validate the expected npm publisher and repository. - Review npm provenance attestations where available. - Verify the package tarball integrity against a trusted, documented digest. - Audit the selected release and its transitive dependencies. 3. Prefer a project-local, lockfile-controlled installation over a global installation. Commit the applicable lockfile so dependency versions and integrity hashes are reproducible. 4. Avoid administrator or root privileges. Run the CLI under a dedicated least-privileged account that cannot access unrelated credentials or system files. 5. Inspect package lifecycle scripts before installation. Where functionality permits, install with lifecycle scripts disabled: ```bash npm install --ignore-scripts @vishalgojha/social-flow@X.Y.Z ``` If lifecycle scripts are required, document and audit each script before allowing execution. 6. Vendor the reviewed implementation or include auditable source in the artifact where practical. This would allow the CLI behavior to be evaluated alongside the skill instructions. 7. Restrict the installed CLI's access to narrowly scoped Meta credentials, test accounts, and required workspaces. Keep production advertising and messaging credentials unavailable until explicitly needed. 8. Establish a controlled upgrade process that reviews release diffs, dependency changes, integrity information, and lifecycle scripts before changing the pinned version.