T08 · Insecure Dependencies
- Location
reference/shared.md:9- Finding
Unpinned Global npm Dependency Installation
- Content
View full analysis
Vulnerability Details
File Location:
reference/shared.md, lines 9–15
Vulnerability Type:T08: Insecure Dependencies
Risk Level: Mediumbash # 安装 npm install -g @volcengine/mediakit-cli # 验证 mediakit-cli --versionTechnical Analysis
The installation instructions retrieve the latest available version of
@volcengine/mediakit-cliand install it globally without an exact version pin, lockfile, or integrity verification. Consequently, the code installed and executed can change after the Skill has been reviewed.npm packages may execute lifecycle scripts during installation. If the package, a transitive dependency, or the associated publisher account is compromised, following these instructions could execute attacker-controlled code with the privileges of the user running npm. Global installation also makes the resulting executable available broadly within the user's environment and increases the impact of an affected release.
The repository does not contain evidence that the named package is currently malicious. This finding concerns the unsafe dependency acquisition process and its exposure to a future supply-chain compromise.
Attack Path
- An attacker compromises the npm publisher account, upstream package repository, or a transitive dependency.
- The attacker publishes a malicious release under the existing package name or causes a malicious dependency version to be selected.
- A user follows the documented command
npm install -g @volcengine/mediakit-cli. - npm resolves and downloads the attacker-controlled release because no exact version or verified integrity value is specified.
- Malicious npm lifecycle code executes during installation, or the installed
mediakit-cliexecutable runs attacker logic when invoked. - The attacker gains code execution under the installing or invoking user's account.
Impact Assessment
Successful exploitation could provide arbitrary ...[truncated 605 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin the CLI to an exact, reviewed version, for example:
bash npm install -g @volcengine/mediakit-cli@<reviewed-version> - Document the expected package digest or npm integrity value and verify package provenance before installation.
- Prefer a project-local dependency managed by a committed lockfile over global installation where operationally feasible.
- Use npm provenance and signature verification mechanisms supported by the deployment environment.
- Disable lifecycle scripts with
--ignore-scriptsif the reviewed package does not require them; otherwise, explicitly review all lifecycle scripts before installation. - Run installation and the resulting CLI as an unprivileged user in a restricted environment.
- Establish a controlled upgrade process in which new versions are reviewed and tested before the pinned version is changed.
- Monitor the direct package and its transitive dependencies for publisher changes, known vulnerabilities, and unexpected release activity.
- Pin the CLI to an exact, reviewed version, for example: