T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:34
- Finding
- Third-Party Packages Installed Without Artifact Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:34`, `SKILL.md:40`, `SKILL.md:1563`, and `SKILL.md:1580` **Vulnerability Type**: Supply-chain dependency integrity weakness **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @maton/cli@0.3.1 ``` ```bash brew install maton-ai/cli/maton brew pin maton ``` ```bash pip install 'maton-ai==0.3.1' ``` ```bash npm install @maton/sdk@0.3.1 ``` ### Technical Analysis The Skill instructs users or agents to retrieve and install executable packages from npm, PyPI, and a custom Homebrew tap. Package versions are pinned, which limits unexpected upgrades, but the instructions do not verify cryptographic signatures, release checksums, package-lock integrity metadata, or another independently trusted artifact identity. Version pinning alone does not protect against compromise of the publisher account, package registry, custom Homebrew tap, release artifact, or transitive dependency graph. If an artifact associated with the pinned version is malicious or replaced upstream, following these instructions can execute attacker-controlled package lifecycle scripts, build backends, Homebrew formula logic, or installed binaries. The global npm installation increases the potential impact because it places the CLI in a broadly accessible executable location. The custom Homebrew tap also introduces a source whose formula and artifact provenance must be trusted separately from the standard Homebrew repositories. ### Attack Path 1. An attacker compromises a Maton publisher account, package registry entry, release-hosting account, custom Homebrew tap, or a transitive dependency. 2. The attacker publishes or substitutes a malicious artifact reachable through one of the documented installation commands. 3. A user or agent follows `SKILL.md` and executes the relevant `npm`, `pip`, or `brew` command. 4. Malicious installation logic or the compromised installed client ...[truncated 1245 chars]
- Remediation
- ## Remediation Suggestions 1. Publish SHA-256 or stronger cryptographic hashes for every supported CLI and SDK release, and require verification before installation. 2. Sign release artifacts and document verification against a pinned, independently distributed signing key. 3. For npm dependencies, provide a lockfile containing integrity metadata and recommend `npm ci` in an isolated project instead of global installation where feasible. 4. For Python, provide a fully pinned requirements file with hashes and use: ```bash pip install --require-hashes -r requirements.txt ``` 5. For Homebrew, document the expected formula revision and artifact checksum, and explain how users can inspect and verify the custom tap before installation. 6. Prefer immutable release artifacts with reproducible-build or provenance attestations such as SLSA-compatible metadata. 7. Run installed tools with the least-privileged account available and isolate them from unrelated credentials and sensitive files. 8. Review transitive dependencies and package-manager lifecycle scripts as part of every release. 9. Avoid global package installation unless it is operationally necessary; otherwise use a dedicated virtual environment, container, or project-local installation.