# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-EXEC-003
title: Do not run on-demand packages without a pinned version
finding:
  title: Scripts and pipelines download and run the latest version of a package
status: draft
profiles: [baseline]
risk:
  severity: medium
assessment: partial
tags: [pinning, ci]
description: |
  Commands that fetch and run a package in one step, without adding it to the project, are not used in pipelines, scripts or documentation unless they pin an exact version that goes through the same release-age and source rules as other dependencies.
rationale: |
  One-shot runners usually resolve the latest version at every run and bypass the lockfile, so a malicious release runs immediately everywhere the command is used.
impact: |
  Tools used this way must be added as pinned development dependencies or pinned in the command.
audit:
  manual: |
    1. Search pipelines, scripts, container files and documentation for one-shot package runner commands.
    2. Check each one pins an exact version.
  checks:
    - id: postmortem
      engine: postmortem
      description: "npx / dlx / uvx / pipx run / go run @latest without a version, in CI, Dockerfiles, scripts"
      spec:
        command: postmortem harden --json
        control: CB-DEP-EXEC-003
        coverage: auto
remediation:
  manual: |
    1. Add the tool as a pinned development dependency, or pin an exact version in the command.
references:
  - title: Package Manager Best Practices
    url: https://github.com/ossf/package-manager-best-practices
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
  - title: OWASP Top 10 CI/CD Security Risks
    url: https://owasp.org/www-project-top-10-ci-cd-security-risks/
    publisher: OWASP
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: CM-7
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
related_controls:
  - id: CB-DEP-AGE-001
    type: related
  - id: CB-DEP-LOCK-002
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16