T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:59
- Finding
- Unpinned Turborepo Scaffolding Package Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md:59-62` **Vulnerability Type**: Unpinned remote package execution **Risk Level**: Medium ```bash # Create new monorepo npx create-turbo@latest my-monorepo cd my-monorepo ``` ### Technical Analysis The documented command uses `npx` to download and immediately execute `create-turbo` through the mutable `latest` distribution tag. The effective code can therefore change after the Skill has been reviewed. This behavior supports the declared monorepo setup functionality, but using a mutable version exceeds the minimum supply-chain trust required. A compromised package publisher, registry account, or newly malicious release could cause arbitrary package lifecycle or scaffolding code to run under the invoking user's account. ### Attack Path 1. An attacker compromises the package publisher, package registry entry, or release process for `create-turbo`. 2. The attacker publishes a malicious release and assigns it to the `latest` tag. 3. A user follows the Skill and runs `npx create-turbo@latest my-monorepo`. 4. `npx` downloads and executes the attacker-controlled release. 5. The malicious process can access files, environment variables, credentials, and network resources available to the invoking user. ### Impact Assessment Successful exploitation permits arbitrary code execution with the privileges of the user running the command. The accessible scope can include the current workspace, user-owned files, developer credentials, package registry configuration, SSH material, and environment variables. No evidence indicates that the Skill itself intentionally supplies a malicious package.
- Remediation
- ## Remediation Suggestions - Replace `@latest` with a reviewed exact version, such as `create-turbo@X.Y.Z`. - Review release provenance, package ownership, and integrity before updating the pinned version. - Run scaffolding tools in an isolated environment without production credentials. - Prefer package-manager controls that validate signatures, provenance, or integrity metadata. - Document a controlled update process that requires review before changing the pinned version.