T08 · Insecure Dependencies
Warning
- Location
- package-lock.json:18
- Finding
- Dependencies Retrieved from a Third-Party npm Mirror## Vulnerability Details **File Location**: `package-lock.json:18-23` **Vulnerability Type**: Third-party dependency supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```json "node_modules/agent-base": { "version": "7.1.4", "resolved": "https://registry.npmmirror.com/agent-base/-/agent-base-7.1.4.tgz", "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==", "license": "MIT", "engines": { ``` Numerous additional `resolved` fields in `package-lock.json` use `https://registry.npmmirror.com/` for packages including Axios, Cheerio, and their transitive dependencies. ### Technical Analysis The installation instructions in `README.md` and `skill.md` direct users to run `npm install`. The lockfile causes npm to retrieve most dependency archives from a third-party mirror rather than the official npm registry. The recorded SHA-512 integrity values provide meaningful protection against a mirror independently replacing an archive with different content: npm should reject an archive that does not match its lockfile hash. However, the project still places availability and distribution trust in an additional external operator. The risk becomes exploitable if the mirror and the lockfile-generation or update process are compromised together, if integrity verification is bypassed, or if future dependency updates are accepted from the mirror without independent review. This is a supply-chain hardening issue rather than evidence that any currently locked package is malicious. No dependency lifecycle scripts were identified in the reviewed lockfile. ### Attack Path 1. An attacker compromises or gains control over the third-party mirror, or otherwise manipulates dependency resolution during a future lockfile update. 2. A malicious package archive and corresponding lockfile metadata are introduced during that update. Merely changing an archive on the mirror ...[truncated 1074 chars]
- Remediation
- ## Remediation Suggestions 1. Configure npm to use the official registry: ```bash npm config set registry https://registry.npmjs.org/ ``` 2. Regenerate `package-lock.json` from a trusted environment so all `resolved` fields reference `https://registry.npmjs.org/`. 3. Use `npm ci` in documentation and automated deployments to enforce the reviewed lockfile without silently updating dependency resolution. 4. Consider pinning direct dependencies to exact versions instead of version ranges. 5. Require review of dependency and integrity changes whenever the lockfile is updated. 6. Add automated dependency vulnerability and provenance checks using tools such as `npm audit`, lockfile linting, and software composition analysis. 7. In higher-assurance environments, proxy approved npm packages through an organization-controlled registry with immutability, access controls, malware scanning, and audit logging.