T08 · Insecure Dependencies
Warning
- Location
- AGENTS.md:188
- Finding
- Unpinned Packages Executed Through npx## Vulnerability Details **File Location**: `AGENTS.md`, lines 188–191 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash # Run axe-core against all pages npx @axe-core/cli http://localhost:8000 --tags wcag2a,wcag2aa,wcag22aa # Run Lighthouse accessibility audit npx lighthouse http://localhost:8000 --only-categories=accessibility --output=json ``` ### Technical Analysis The documented workflow instructs the agent to execute `@axe-core/cli` and `lighthouse` through `npx` without specifying reviewed package versions. If these packages are unavailable locally, `npx` can retrieve and immediately execute them from the configured package registry. Because neither dependency is pinned through an exact version and lockfile nor restricted to an existing local installation, the code executed by this workflow can change after the Skill has been reviewed. Security therefore depends on the integrity of the package registry, package maintainer accounts, dependency graph, and local npm configuration. Exploitation would require a malicious or compromised package release, compromised transitive dependency, or attacker-controlled registry configuration. There is no evidence in the audited files that the named packages are currently malicious. ### Attack Path 1. An attacker compromises a referenced package, one of its dependencies, or the package registry/configuration used by the environment. 2. The attacker publishes or serves a malicious version under a package name used by the workflow. 3. The accessibility-audit workflow is invoked on a system where the required package version is not securely installed and locked. 4. `npx` resolves and downloads the unpinned package from the configured registry. 5. Package lifecycle behavior or CLI entry-point code executes with the privileges of the user running the agent. 6. The malicious code can access resources available to ...[truncated 775 chars]
- Remediation
- ## Remediation Suggestions 1. Add the required tools to a reviewed project manifest using exact versions rather than version ranges. 2. Commit the generated lockfile and install dependencies with a frozen or immutable lockfile workflow, such as `npm ci`. 3. Invoke only locally installed binaries. For example: ```bash npx --no-install axe http://localhost:8000 --tags wcag2a,wcag2aa,wcag22aa npx --no-install lighthouse http://localhost:8000 --only-categories=accessibility --output=json ``` 4. Alternatively, invoke the binaries directly from `node_modules/.bin` after a verified installation. 5. Validate package integrity and provenance during dependency installation, and review package and transitive-dependency changes before updating the lockfile. 6. Use a trusted registry configured over TLS and prevent project or user npm configuration from silently redirecting dependency resolution to an untrusted source. 7. Run audit tooling in a restricted environment with minimal filesystem access, no unnecessary credentials, and constrained outbound network access.