T08 · Insecure Dependencies
Warning
- Location
references/getting-started.md:5- Finding
Unpinned third-party packages and remotely hosted scripts
- Content
View full analysis
``` `references/getting-started.md:31-32`: ```html ``` `references/place-autocomplete.md:442`: ```html ``` ### Technical Analysis The installation command does not specify an exact package version. It therefore resolves according to the package registry's current metadata and the consuming project's package-manager configuration. A future release, compromised publisher account, or manipulated package-distribution path could cause users to install code that was not reviewed when this Skill was audited. Package installation may also invoke lifecycle scripts with the privileges of the developer or build environment. The unpkg references similarly omit an immutable package version and do not provide a Subresource Integrity hash. The JavaScript response is executed directly in the application's browser origin and can change independently of this repository. The remotely hosted Baidu Maps API is also executed without an integrity control, although this is an expected functional dependency and may be intentionally updated by its provider. The CSS resource is not equivalent to arbitrary JavaScript execution, but loading mutable third-party styles c ...[truncated 1829 chars]- Remediation
View remediation
``` 5. Generate integrity hashes from independently reviewed artifacts. Do not obtain both the artifact and expected hash from an untrusted response during the same deployment. 6. Prefer self-hosting reviewed JavaScript and CSS artifacts when licensing and update requirements permit. 7. Deploy a restrictive Content Security Policy that explicitly limits `script-src`, `style-src`, and `connect-src` to required origins. Avoid allowing `unsafe-inline` or `unsafe-eval` unless strictly necessary. 8. Restrict the Baidu Maps API key by approved web origins and enabled APIs through the provider's controls. Use separate keys for development and production, monitor usage, and rotate keys if exposure or abuse is suspected. 9. Document a controlled dependency-update process that includes security review, integrity regeneration, testing, and rollback procedures. ]]>