T08 · Insecure Dependencies
Warning
- Location
- reference/shared.md:11
- Finding
- Unpinned Global Installation of a Third-Party CLI Package<![CDATA[ ## Vulnerability Details **File Location**: `reference/shared.md`, lines 11–16 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```bash # Install npm install -g @volcengine/mediakit-cli # Verify mediakit-cli --version ``` ### Technical Analysis The setup instructions install `@volcengine/mediakit-cli` globally without specifying an exact version or verifying package integrity. Consequently, installation resolves to whichever package version is current in the configured npm registry at execution time. The effective dependency can therefore change after this Skill has been reviewed. A global npm installation may execute package lifecycle scripts with the privileges of the user running npm. Depending on the host's npm configuration, a user might also run the command with elevated privileges to access the global installation directory, increasing the potential impact. The package scope is consistent with the declared Volcengine product, and the audited files do not reference an unknown registry or establish that the package is currently malicious. The vulnerability is the mutable, unverified supply-chain dependency rather than evidence of an existing malicious payload. ### Attack Path 1. An attacker compromises the npm package, its publisher credentials, its release pipeline, or the npm registry account. 2. The attacker publishes a malicious version under the same package name. 3. A user follows the Skill instructions and runs the unpinned global installation command. 4. npm resolves and downloads the attacker-controlled release. 5. Malicious package code or lifecycle scripts execute during installation or when `mediakit-cli` is subsequently invoked. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user performing the installation. This may permit access to user-readable files, media supplied to the CLI, MediaKit configuratio ...[truncated 361 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to an exact reviewed version, for example: ```bash npm install -g @volcengine/mediakit-cli@<audited-version> ``` 2. Document the expected npm registry and reject installation from untrusted registry overrides. 3. Verify the package tarball against a publisher-provided integrity value or cryptographic signature before installation. 4. Prefer a project-local dependency with a committed lockfile instead of a global installation. 5. Perform dependency and provenance checks whenever the pinned version is upgraded. 6. Avoid running npm with administrative privileges. If global installation is necessary, use a user-owned installation prefix. 7. Consider executing the CLI in a restricted environment with only the filesystem and network access required for media processing. ]]>