T08 · Insecure Dependencies
Warning
- Location
- README.md:23
- Finding
- Unpinned Third-Party Installer Can Execute Mutable Remote Code## Vulnerability Details **File Location**: `README.md`, lines 23-25 **Vulnerability Type**: Supply-chain risk through an unpinned npm installer and mutable GitHub source **Risk Level**: Medium **Vulnerable Code**: ```bash npx add https://github.com/wpank/ai/tree/main/skills/backend/postgres-job-queue ``` ### Technical Analysis The installation command invokes `npx`, which can download and execute the third-party npm package named `add`. No exact package version or integrity hash is specified. The content supplied to that installer is also referenced through a mutable GitHub path rather than an immutable, reviewed commit. Consequently, the code executed during installation may differ from the content reviewed during this audit. Compromise of the npm package, its publisher account, the GitHub account, or the referenced upstream branch could introduce attacker-controlled behavior without requiring any change to this repository. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the GitHub repository, or another relevant upstream distribution channel. 2. The attacker publishes malicious installer logic or modifies content available through the mutable GitHub reference. 3. A user follows the documented installation instructions and runs the `npx add ...` command. 4. `npx` retrieves and executes the affected third-party package. 5. The malicious installer executes with the privileges and environment access of the user running the command. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's privileges and environment, attacker code could read or modify accessible files, steal credentials or environment variables, alter development projects, install additional malicious components, or access resources available to the user. System-wide compromise would require the command to be run with elevated pr ...[truncated 49 chars]
- Remediation
- ## Remediation Suggestions - Do not use an implicitly resolved `npx` package for simple file installation. - Pin every required npm package to an exact, reviewed version and use lockfiles or integrity verification where applicable. - Pin the GitHub source to an immutable commit hash rather than a mutable branch or directory URL. - Prefer downloading an archive without executing remote installer code, verifying its published cryptographic checksum or signature, and copying only the audited files. - Publish and document expected checksums for each approved release. - If an installer is unavoidable, review its source, constrain its permissions, run it in an isolated environment, and avoid invoking it with administrative privileges.