T08 · Insecure Dependencies
Warning
- Location
- README.md:29
- Finding
- Unpinned Third-Party Code Execution Through npx## Vulnerability Details **File Location**: `README.md`, line 29 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash npx add https://github.com/wpank/ai/tree/main/skills/api/api-versioning ``` ### Technical Analysis The installation command invokes `npx` with the unversioned package name `add`. If the package is not already available locally, `npx` can retrieve and execute it from the configured npm registry. The command does not pin the executable package to a reviewed version or verify its integrity. The GitHub source is also referenced through a mutable repository path rather than an immutable commit hash. Consequently, the effective installation content may change after this project has been audited. This creates a supply-chain trust boundary involving both the npm package used as the installer and the external GitHub repository. This finding does not establish that either external source is currently malicious. The vulnerability is that the documented workflow permits subsequently modified or compromised third-party code to execute during installation without immutable version or integrity controls. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the configured package registry, the GitHub account, or the referenced repository. 2. The attacker publishes a malicious release of the unpinned `add` package or modifies content reachable through the mutable repository path. 3. A user follows the documented installation command. 4. `npx` retrieves and executes the externally controlled package in the user's environment. 5. Malicious installer or lifecycle code executes with the permissions and environmental access of the invoking user. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope may include project files, user-owned files, en ...[truncated 526 chars]
- Remediation
- ## Remediation Suggestions - Avoid executing an unpinned registry package through `npx` for installation. - Use a trusted installer pinned to an exact package version, and enforce package-lock and integrity verification where supported. - Pin the external repository to a reviewed immutable commit hash or signed release rather than a mutable branch path. - Prefer a non-executing installation process, such as downloading or cloning a pinned revision and copying the required files. - Verify release signatures or published checksums before installation. - Document the exact expected package identity, version, source commit, and checksum. - Run any unavoidable installer in a restricted environment with no unnecessary credentials, minimal filesystem permissions, and no administrative privileges. - In CI/CD environments, allowlist dependencies and prevent installation scripts from accessing deployment secrets unless strictly required.