T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:18
- Finding
- Unpinned Third-Party npm Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 18–25 **Vulnerability Type**: Unpinned and automatically executed third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @wavespeed/cli wavespeed login # opens https://wavespeed.ai/accesskey and stores the key wavespeed status # confirms you are signed in ``` ```text Prefer MCP tools over shell commands? The same platform is exposed by [`@wavespeed/mcp`](https://github.com/WaveSpeedAI/mcp-server) (`npx -y @wavespeed/mcp`; tools `search_models`, `get_model_schema`, `get_price`, `upload_file`, `run_model`, `get_prediction`). ``` ### Technical Analysis The instructions install `@wavespeed/cli` globally without specifying an audited version. They also use `npx -y @wavespeed/mcp`, which resolves, downloads, and executes the currently published package while automatically accepting installation. Neither command provides a version constraint, lockfile, or integrity hash. Consequently, the code executed at installation or runtime may differ from the code that was reviewed. npm packages can execute lifecycle scripts during installation and arbitrary logic at runtime. A compromised publisher account, malicious package release, or compromised transitive dependency could therefore introduce attacker-controlled code. The global installation increases exposure by placing package files and executables in the user's npm global prefix. The MCP command introduces additional risk because `npx -y` downloads and executes the mutable package without an interactive approval step. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or a transitive dependency used by `@wavespeed/cli` or `@wavespeed/mcp`. 2. The attacker publishes a malicious package version containing an installation lifecycle script or malicious runtime code. 3. A user or agent follows the documented setup instructi ...[truncated 1325 chars]
- Remediation
- ## Remediation Suggestions 1. Pin each package to a specific version that has been reviewed, for example: ```bash npm install --global @wavespeed/cli@<reviewed-version> npx @wavespeed/mcp@<reviewed-version> ``` 2. Avoid `npx -y` because it suppresses the installation confirmation. Prefer installing an audited version in a controlled project environment and invoking its local executable. 3. Avoid global installation where possible. Use a project-local dependency with a committed lockfile to constrain the package and its transitive dependency versions. 4. Verify package provenance, publisher identity, release signatures or attestations, and npm integrity metadata before installation. 5. Use `npm ci` with a committed lockfile in automated environments rather than resolving current package versions dynamically. 6. Run third-party tooling with least privilege in an isolated container or restricted account. Expose only the files and credentials needed for the requested operation. 7. Disable npm lifecycle scripts during installation where compatible by using `--ignore-scripts`, and separately review any scripts required for legitimate operation. 8. Document an approved package version and a controlled update process that requires security review before changing it.