Do not run on-demand packages without a pinned version

Description

Commands that fetch and run a package in one step, without adding it to the project, are not used in pipelines, scripts or documentation unless they pin an exact version that goes through the same release-age and source rules as other dependencies.

Rationale

One-shot runners usually resolve the latest version at every run and bypass the lockfile, so a malicious release runs immediately everywhere the command is used.

Impact

Tools used this way must be added as pinned development dependencies or pinned in the command.

Audit

1. Search pipelines, scripts, container files and documentation for one-shot package runner commands.
2. Check each one pins an exact version.

Automated: every check must pass. Scanners report each check by its id.

postmortem

npx / dlx / uvx / pipx run / go run @latest without a version, in CI, Dockerfiles, scripts

command: postmortem harden --json
control: CB-DEP-EXEC-003
coverage: auto

Remediation

1. Add the tool as a pinned development dependency, or pin an exact version in the command.

References

• Package Manager Best Practices OpenSSF, guide, accessed 2026-10-16
• OWASP Top 10 CI/CD Security Risks OWASP, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-AGE-001 Wait a minimum age before installing a new package version
• related CB-DEP-LOCK-002 Install from the lockfile without modifying it in builds

People and lifecycle