T08 · Insecure Dependencies
Warning
- Location
- package.json:29
- Finding
- Dependency Installation Uses Mutable Versions and an Unreviewed External Local Package## Vulnerability Details **File Location**: `package.json:29-44`; installation is directed by `SKILL.md:14-17` and `README.md:25-30` **Vulnerability Type**: Supply-chain risk from unpinned and externally sourced dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:14-17`: ```bash # Install npm install npm run build ``` `README.md:25-30`: ```bash ## Installation ```bash cd agent-credit-system npm install ``` ``` `package.json:29-44`: ```json "devDependencies": { "@types/jest": "^30.0.0", "@types/node": "^25.2.0", "jest": "^30.2.0", "ts-jest": "^29.4.6", "typescript": "^5.9.3" }, "dependencies": { "@circle-fin/developer-controlled-wallets": "^10.1.0", "@circle/openclaw-wallet-skill": "file:../skills/circle-wallet", "@types/uuid": "^10.0.0", "axios": "^1.13.4", "commander": "^14.0.3", "dotenv": "^17.2.3", "node-forge": "^1.3.3", "uuid": "^13.0.0" } ``` ### Technical Analysis The documented installation process instructs users or agents to execute `npm install`, but the artifact contains no dependency lockfile. Most dependencies use caret version ranges, allowing npm to resolve versions other than those represented when the package was originally prepared or reviewed. The dependency `@circle/openclaw-wallet-skill` is loaded through `file:../skills/circle-wallet`. This path is outside the audited project directory, and the referenced package was not included in the supplied artifact. Its source code, transitive dependencies, and npm lifecycle scripts therefore cannot be verified. npm installations can execute dependency lifecycle scripts with the permissions of the user running npm. Because this project concerns cryptocurrency wallets and documents Circle API credentials, malicious or compromised dependency code could potentially access sensitive environment variables and files available to that process. No evidence establishes th ...[truncated 1623 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete source of `../skills/circle-wallet` within the auditable project boundary, or replace the external file dependency with an explicitly reviewed and integrity-controlled package. 2. Pin security-sensitive production dependencies to exact reviewed versions rather than caret ranges. 3. Generate, review, and commit `package-lock.json`. 4. Use `npm ci` in documented installation and CI procedures to enforce the committed dependency graph. 5. Review direct and transitive dependency lifecycle scripts before installation. 6. Use `npm install --ignore-scripts` where lifecycle scripts are unnecessary, enabling only specifically reviewed build steps afterward. 7. Run installation and builds under an unprivileged account with a restricted environment that does not contain wallet or API credentials. 8. Add dependency auditing, provenance verification, and automated vulnerability scanning to CI. 9. Document why wallet and cryptographic dependencies are required and ensure that credential-bearing runtime environments are separated from dependency installation environments.