T08 · Insecure Dependencies
Warning
- Location
- setup.md:27
- Finding
- Unpinned Puppeteer Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `setup.md:27-31` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown If not installed: ```bash npm install puppeteer # or for lighter install (uses system Chrome): npm install puppeteer-core ``` ``` ### Technical Analysis The setup instructions install Puppeteer or Puppeteer Core without specifying an exact version, lockfile, integrity hash, or verified registry. Consequently, the package and its transitive dependency graph are resolved at installation time and may differ from the versions originally reviewed. NPM installations can invoke package lifecycle scripts with the privileges of the Agent's operating-system account. If the selected package release, a transitive dependency, or the configured package registry is compromised, arbitrary code could execute during installation. The absence of version and integrity constraints also creates a reproducibility and compatibility risk. This finding does not establish that the legitimate Puppeteer packages are malicious. The vulnerability is the mutable and unverified dependency-installation process. ### Attack Path 1. An attacker compromises a future package release, one of its transitive dependencies, or the package registry used by the environment. 2. The Agent follows `setup.md` and runs `npm install puppeteer` or `npm install puppeteer-core`. 3. NPM resolves the current package graph rather than a previously audited, immutable version. 4. Malicious lifecycle code executes under the Agent user's account during installation. 5. The payload can access resources available to that account, modify user-owned files, or alter subsequent browser-automation behavior. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user running NPM. The accessible scope may include user-owned files, environment variables, project data, brows ...[truncated 190 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin Puppeteer to an exact, reviewed version rather than relying on the mutable latest release: ```bash npm install --save-exact puppeteer@<reviewed-version> ``` 2. Include and review `package.json` and `package-lock.json`, then use `npm ci` for deterministic installations. 3. Preserve and validate registry-provided integrity hashes in the lockfile. 4. Explicitly require the official trusted NPM registry and reject unexpected registry overrides. 5. Review package lifecycle scripts and consider `npm ci --ignore-scripts` where lifecycle scripts are unnecessary. 6. Perform dependency vulnerability and provenance checks before updating the pinned version. 7. Run installation in a least-privileged, isolated environment without sensitive environment variables. ]]>