T08 · Insecure Dependencies
Warning
- Location
- scripts/package.json:9
- Finding
- Unpinned Dependency Installation Without a Lockfile<![CDATA[ ## Vulnerability Details **File Location**: `scripts/package.json:9-11`; installation instructions at `SKILL.md:26-29` **Vulnerability Type**: Supply-chain exposure caused by mutable dependency resolution **Risk Level**: Medium ### Vulnerable Code ```json "dependencies": { "sharp": "^0.32.6" } ``` The documented installation procedure is: ```bash cd scripts npm install ``` The audited project contains no `package-lock.json` or other dependency lockfile. ### Technical Analysis The caret constraint `^0.32.6` allows npm to resolve a compatible version other than the specific version reviewed by the project author. The absence of a lockfile also leaves the complete transitive dependency graph unresolved until installation time. Consequently, separate installations can retrieve different package artifacts and transitive dependency versions. If an allowed dependency release or one of its transitive dependencies is compromised, the project may install unreviewed code. npm package installation can also run dependency lifecycle scripts unless scripts are explicitly disabled. No malicious dependency or currently exploited package behavior was identified in the audited files. The vulnerability is the non-reproducible and mutable trust boundary created by the dependency configuration and documented installation process. ### Attack Path 1. An attacker compromises an allowed release of `sharp`, a transitive package, or the relevant package-distribution channel. 2. The attacker publishes malicious package content within a version accepted by the declared range or alters a transitively resolved artifact. 3. A user follows `SKILL.md` and runs `npm install`. 4. npm resolves the dependency graph at installation time because no lockfile fixes the reviewed artifacts. 5. Malicious package code or an installation lifecycle script executes with the privileges of the account running npm. 6. The compromised dependency may subsequently execute again when `resize_ima ...[truncated 566 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `sharp` to an exact, reviewed version rather than a mutable caret range: ```json "dependencies": { "sharp": "0.32.6" } ``` 2. Generate and commit `package-lock.json` so direct and transitive dependency versions and integrity hashes are reproducible. 3. In deployment and automated build environments, replace `npm install` with: ```bash npm ci ``` 4. Where compatible with the dependency's native installation requirements, disable lifecycle scripts: ```bash npm ci --ignore-scripts ``` 5. If lifecycle scripts are necessary, review them and perform installation in a sandboxed environment with minimal filesystem access, no unnecessary credentials, and no privileged account. 6. Add automated dependency vulnerability and integrity scanning to the release process. 7. Review and deliberately update the lockfile instead of permitting dependency versions to change implicitly during installation. ]]>