Rules / GL022

GL022 Package manager install without version pin

Severity: warn
OWASP: CICD-SEC-3 – Dependency Chain Abuse

What glsec checks

glsec flags four categories of problematic package manager usage in CI scripts:

1. Install without a pinned version — pulls whatever is latest at the time the job runs, making the pipeline non-reproducible. A compromised or updated package can silently change pipeline behaviour.

2. Ad-hoc dependency installs — a named package installed on top of the manifest (npm install lodash, yarn add left-pad, pnpm add chalk, bundle add rails) is in no lockfile, so the registry decides the version on every run and the dependency never shows up in a lockfile diff. yarn add and bundle add additionally rewrite the manifest in place, so a later strict install works from modified input.

3. Fetch-and-run launchers: npx -y, pnpm dlx, yarn dlx, uvx and pipx run resolve a package from the registry and execute it in the same step. No lockfile or manifest is involved, and the code runs immediately with the job's environment and tokens.

4. Explicit update-to-latest commands — commands like npm update, composer update, or pip install --upgrade are designed for local development workflows and are almost never appropriate in CI.

Detected package managers

Unpinned installs

Fetch-and-run launchers

Explicit update commands (always flagged)

npm update, yarn upgrade, pnpm update, composer update, bundle update, gem update, cargo update, pip install --upgrade <pkg>

Trigger examples

build:
  script:
    - pip install ansible              # unpinned
    - npm install lodash               # ad-hoc dependency, no lockfile entry
    - yarn add left-pad@latest         # dist-tag, not a version
    - bundle add rails                 # ad-hoc gem
    - npm install -g @angular/cli      # unpinned scoped package
    - apt-get install -y jq            # unpinned
    - composer require guzzlehttp/guzzle  # unpinned
    - npm update                       # explicit update
    - composer update                  # explicit update
    - pip install --upgrade ansible    # explicit upgrade
    - npx -y surge dist                # fetched and run, unpinned
    - pnpm dlx node-gyp rebuild        # fetched and run, unpinned
    - uvx ruff check                   # fetched and run, unpinned

Safe alternatives

build:
  script:
    - pip install ansible==9.2.0
    - npm install lodash@4.17.21
    - yarn add left-pad@1.3.0
    - bundle add rails -v 7.1.3
    - npm install -g @angular/cli@17.3.6
    - apt-get install -y jq=1.6-2
    - apk add --no-cache curl=8.5.0-r0
    - gem install bundler -v 2.5.6
    - cargo install cargo-audit --version 0.20.0
    - composer require guzzlehttp/guzzle:^7.8
    - npx -y surge@0.24.6 dist
    - pnpm dlx node-gyp@10.2.0 rebuild
    - uvx ruff@0.6.9 check

Notes

• pip install -r requirements.txt and pip install . are not flagged — use of a requirements file or local package install is expected.
• Bare npm install (no package argument) is not flagged here — it installs from package.json; see GL023 for the lockfile concern. Only an explicitly named package is treated as an ad-hoc install.
• Dist-tags (@latest, @next) are not versions and are flagged.
• Local and workspace targets (npm install ./pkg, yarn add file:../shared, pnpm add link:../shared, pnpm add workspace:@app/shared) are not flagged — nothing is fetched from a registry.
• Package names that appear inside a quoted string (e.g. an error message that reads echo "run npm install locally") are not flagged. As a consequence, a quoted package argument such as yarn add "left-pad@1.3.0" is not inspected either.
• npm install -g @scope/pkg (scoped package without version) is flagged; @scope/pkg@version is safe.
• composer install (reads composer.lock) is not flagged — only composer require (adds a new package) and composer update (updates to latest) are.
• go install of a remote module without @version (or with @latest) is flagged; @v1.2.3 is safe. Local builds (go install, go install ./cmd/...) are not flagged.
• Installs whose package argument is a CI variable (e.g. apt-get install -y $PKG, yum install $PKG) are not flagged — the version can't be checked statically.
• Plain npx <bin> (no -y/--yes, no dist-tag) is not flagged. npx resolves node_modules/.bin first, so this form almost always runs a project devDependency that the lockfile already pins.
• A local project as the launcher's source (uvx --from . tool, pipx run --spec . tool, pnpm dlx ./tool) is not flagged.
• For project-level dependency lockfile concerns (e.g. npm install vs npm ci), see GL023.

Documentation for glsec 1.23.0. Source of this page · Rule implementation