T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 17–20 **Vulnerability Type**: Unpinned third-party npm dependency **Risk Level**: Medium ```bash npm install -g @wavespeed/cli wavespeed login # opens https://wavespeed.ai/accesskey and stores the key wavespeed status # confirms you are signed in ``` ### Technical Analysis The setup instructions install the latest registry version of `@wavespeed/cli` globally without an exact version, lockfile, checksum, or package-provenance verification. Consequently, the code installed when a user follows these instructions may differ from the version reviewed during the skill audit. A compromised package release, maintainer account, or npm registry resolution could introduce malicious installation lifecycle scripts or runtime code. Global installation also makes the package broadly available in the user's environment and can require elevated permissions on some systems. No evidence establishes that the named package is currently malicious. The finding concerns the unsafe dependency acquisition method and its supply-chain exposure. ### Attack Path 1. An attacker compromises the package publisher, publishing pipeline, or relevant registry resolution. 2. The attacker publishes a malicious version under the expected package name. 3. A user follows the skill instructions and runs `npm install -g @wavespeed/cli`. 4. npm resolves the unpinned dependency to the malicious release. 5. Malicious lifecycle or CLI runtime code executes with the invoking user's effective permissions. 6. The code may access files and environment variables available to that user, modify user-writable resources, or misuse locally stored credentials. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the invoking user's privileges. The accessible scope may include user-owned files, environment variables, authentication material readable by the process, and user-writable configurati ...[truncated 166 chars]
- Remediation
- ## Remediation Suggestions - Pin the CLI to a reviewed exact version, such as `npm install @wavespeed/cli@X.Y.Z`. - Prefer a project-local or isolated installation instead of a global installation. - Commit and enforce an npm lockfile where the surrounding execution model permits it. - Verify npm package provenance and integrity before installation. - Review package lifecycle scripts and use `--ignore-scripts` when they are unnecessary. - Document a controlled upgrade and security-review process. - Advise users not to run installation with administrator privileges unless strictly required.