stylelint.yml installs unpinned npm dependencies — supply chain risk
DESCRIPTION:
The stylelint.yml workflow installs stylelint and stylelint-config-standard globally from npm with no version constraints. A malicious publish to either package on npm would execute arbitrary code in the CI runner. Versions should be pinned (e.g., npm install --global stylelint@16.6.0 stylelint-config-standard@36.0.1).
REPRODUCTION:
.github/workflows/stylelint.yml, line 22:
- run: npm install --global stylelint stylelint-config-standard
IMPACT:
Medium — supply chain vulnerability. Unpinned npm install allows arbitrary code execution via malicious package version.
RELATED FILES:
.github/workflows/stylelint.yml (line 22)
stylelint.yml installs unpinned npm dependencies — supply chain risk
DESCRIPTION:
The
stylelint.ymlworkflow installsstylelintandstylelint-config-standardglobally from npm with no version constraints. A malicious publish to either package on npm would execute arbitrary code in the CI runner. Versions should be pinned (e.g.,npm install --global stylelint@16.6.0 stylelint-config-standard@36.0.1).REPRODUCTION:
.github/workflows/stylelint.yml, line 22:IMPACT:
Medium — supply chain vulnerability. Unpinned npm install allows arbitrary code execution via malicious package version.
RELATED FILES:
.github/workflows/stylelint.yml(line 22)