T03 · Remote Payload Retrieval and Execution
Warning
- Location
- README.md:23
- Finding
- Mutable Remote Source Passed to an Unpinned npx Package<![CDATA[ ## Vulnerability Details **File Location**: `README.md:23-27` **Vulnerability Type**: Remote payload retrieval through an unpinned package and mutable GitHub source **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installation ```bash npx add https://github.com/wpank/ai/tree/main/skills/testing/clean-code ``` ``` ### Technical Analysis The installation command uses `npx` to retrieve and execute the package named `add` without specifying a version. It also supplies a GitHub tree URL that refers to mutable content rather than an immutable commit. This creates two trust dependencies that can change after the skill has been audited: 1. The package resolved by `npx add` is not version-pinned. 2. The content under the GitHub branch or tree URL can be changed by the repository owner or by an attacker who compromises the repository. Because `npx` executes the resolved package as the current user, compromise of the npm package, package publisher, GitHub repository, or associated accounts could turn the documented installation command into arbitrary local code execution. The URL is also associated with a personal GitHub namespace rather than an immutable, integrity-verified release artifact. ### Attack Path 1. An attacker compromises the publisher of the npm package resolved as `add`, or compromises the referenced GitHub repository. 2. The attacker publishes a malicious package version or modifies the mutable repository content. 3. A user follows the documented installation command. 4. `npx` downloads and executes the currently resolved package code. 5. The malicious code runs with the permissions of the user who invoked the command. 6. The payload can access files and credentials available to that user, alter local development configuration, or download additional payloads. ### Impact Assessment Successful exploitation would provide code execution with the invoking user's privileges. The affected scope could include: - Reading or modify ...[truncated 524 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not use an unversioned generic package such as `npx add`. 2. Use a verified installer from a trusted package namespace. 3. Pin the installer to an exact reviewed version rather than using implicit latest-version resolution. 4. Reference an immutable Git commit or signed release artifact instead of a mutable branch URL. 5. Verify artifact integrity with a documented checksum or package-lock integrity value. 6. Prefer downloading and inspecting the skill before installation rather than executing remote code directly. 7. Document the expected publisher, repository, commit, and checksum so users can verify provenance. A hardened installation flow should follow this model: ```bash npx trusted-installer@<reviewed-exact-version> \ https://github.com/<verified-owner>/<verified-repository>/tree/<immutable-commit>/skills/testing/clean-code ``` The exact package, version, commit, and integrity value should be selected and verified by the project maintainer. ]]>