T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Unpinned Third-Party npm Packages Permit Supply-Chain Code Execution## Vulnerability Details **File Location**: `SKILL.md:6` and `decrypt-email.mjs:23-27` **Vulnerability Type**: Unpinned and unverifiable third-party dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:6`: ```markdown **CLI:** `npm i -g @agntos/agentos` (or `npx @agntos/agentos`) ``` `decrypt-email.mjs:23-27`: ```javascript try { nacl = (await import("tweetnacl")).default; } catch { console.error("Install tweetnacl: npm i tweetnacl tweetnacl-util"); process.exit(1); } ``` ### Technical Analysis The documented installation commands do not pin `@agntos/agentos`, `tweetnacl`, or `tweetnacl-util` to reviewed versions. The project also contains no package manifest, lockfile, package integrity metadata, or signature-verification procedure. As a result, npm resolves mutable package releases at installation time. The `npx @agntos/agentos` alternative is particularly sensitive because it can download and immediately execute the currently published package. Package lifecycle scripts, transitive dependencies, and CLI entry points may all execute code with the privileges of the invoking user. This creates a supply-chain trust boundary in which the code executed by users can differ from the code reviewed during the audit. Exploitation would require compromise or malicious control of a package publisher, package release, registry response, or transitive dependency. ### Attack Path 1. An attacker compromises a referenced npm publisher account, package release process, registry delivery path, or transitive dependency. 2. The attacker publishes a malicious release under one of the unpinned package names. 3. A user follows the documented `npm i -g`, `npx`, or dependency-installation instruction. 4. npm resolves and downloads the attacker-controlled release because no exact reviewed version or integrity value is required. 5. Malicious lifecycle hooks, dependency initialization code, or CLI entry-po ...[truncated 1064 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct dependency and documented CLI to an exact reviewed version rather than relying on the latest published release. 2. Add a `package.json` and committed lockfile generated from a trusted dependency-resolution environment. 3. Use reproducible installation commands such as `npm ci` for the helper's dependencies. 4. Replace unpinned `npx @agntos/agentos` guidance with an exact version, for example `npx @agntos/agentos@<reviewed-version>`. 5. Pin `tweetnacl` as a declared dependency and remove the ad hoc instruction to install both packages at their latest versions. 6. Verify package provenance, publisher identity, repository linkage, and npm integrity metadata before approving version updates. 7. Review transitive dependencies and lifecycle scripts as part of every dependency upgrade. 8. Prefer execution in a restricted environment with minimal filesystem, wallet, SSH-agent, and network access. 9. Avoid installing the CLI with elevated privileges and document the minimum permissions required for each workflow.