T08 · Insecure Dependencies
- Location
package-lock.json:18- Finding
Dependencies Retrieved from a Third-Party npm Mirror
- Content
View full analysis
Vulnerability Details
File Location:
package-lock.json:18-23
Vulnerability Type: Third-party dependency supply-chain exposure
Risk Level: MediumVulnerable Code
json "node_modules/agent-base": { "version": "7.1.4", "resolved": "https://registry.npmmirror.com/agent-base/-/agent-base-7.1.4.tgz", "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==", "license": "MIT", "engines": {Numerous additional
resolvedfields inpackage-lock.jsonusehttps://registry.npmmirror.com/for packages including Axios, Cheerio, and their transitive dependencies.Technical Analysis
The installation instructions in
README.mdandskill.mddirect users to runnpm install. The lockfile causes npm to retrieve most dependency archives from a third-party mirror rather than the official npm registry.The recorded SHA-512 integrity values provide meaningful protection against a mirror independently replacing an archive with different content: npm should reject an archive that does not match its lockfile hash. However, the project still places availability and distribution trust in an additional external operator. The risk becomes exploitable if the mirror and the lockfile-generation or update process are compromised together, if integrity verification is bypassed, or if future dependency updates are accepted from the mirror without independent review.
This is a supply-chain hardening issue rather than evidence that any currently locked package is malicious. No dependency lifecycle scripts were identified in the reviewed lockfile.
Attack Path
- An attacker compromises or gains control over the third-party mirror, or otherwise manipulates dependency resolution during a future lockfile update.
- A malicious package archive and corresponding lockfile metadata are introduced during that update. Merely changing an archive on the mirror ...[truncated 1074 chars]
- Remediation
View remediation
Remediation Suggestions
- Configure npm to use the official registry:
bash npm config set registry https://registry.npmjs.org/ - Regenerate
package-lock.jsonfrom a trusted environment so allresolvedfields referencehttps://registry.npmjs.org/. - Use
npm ciin documentation and automated deployments to enforce the reviewed lockfile without silently updating dependency resolution. - Consider pinning direct dependencies to exact versions instead of version ranges.
- Require review of dependency and integrity changes whenever the lockfile is updated.
- Add automated dependency vulnerability and provenance checks using tools such as
npm audit, lockfile linting, and software composition analysis. - In higher-assurance environments, proxy approved npm packages through an organization-controlled registry with immutability, access controls, malware scanning, and audit logging.
- Configure npm to use the official registry: