T08 · Insecure Dependencies
Warning
- Location
- package.json:38
- Finding
- Unaudited Local Dependency Outside the Project Boundary## Vulnerability Details **File Location**: `package.json:36-45`; installation is directed by `README.md:13-18`, `README.md:24-29`, and `SKILL.md:10-13` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium The dependency configuration includes a package resolved from a sibling directory outside the audited project: ```json "dependencies": { "@circle-fin/developer-controlled-wallets": "^10.1.0", "@circle/openclaw-wallet-skill": "file:../skills/circle-wallet", "@types/uuid": "^10.0.0", "axios": "^1.13.4", "commander": "^14.0.3", "dotenv": "^17.2.3", "node-forge": "^1.3.3", "uuid": "^13.0.0" } ``` Users are instructed to install these dependencies: ```bash npm install npm run build ``` ### Technical Analysis The `file:../skills/circle-wallet` dependency crosses the audited artifact boundary and loads a package from the local environment. The referenced sibling package was not included in the supplied project, so its source code, package metadata, and npm lifecycle scripts could not be reviewed. During `npm install`, npm may execute lifecycle scripts declared by dependencies. If the sibling directory contains an attacker-controlled package, its installation scripts can execute with the privileges of the user running npm. The absence of a committed lockfile also means registry dependencies specified with caret ranges may resolve to different permitted versions over time, reducing build reproducibility and increasing supply-chain exposure. No evidence establishes that the referenced package or registry dependencies are currently malicious. The risk arises from trusting unaudited, environment-dependent dependency content during the documented installation procedure. ### Attack Path 1. An attacker gains the ability to create or modify `../skills/circle-wallet` relative to the KarmaBank package directory. 2. The attacker supplies a valid npm package at that location and ...[truncated 1206 chars]
- Remediation
- ## Remediation Suggestions 1. Include the wallet dependency inside the reviewed repository or replace the relative `file:` dependency with a trusted, published package pinned to an exact version. 2. Audit the dependency's source code and all npm lifecycle scripts before installation. 3. Commit an npm lockfile containing exact dependency resolutions and integrity hashes, and use `npm ci` for reproducible installations. 4. Pin security-sensitive dependencies to reviewed versions instead of relying only on mutable caret ranges. 5. Run installation with lifecycle scripts disabled, such as `npm ci --ignore-scripts`, unless particular scripts are documented and required. 6. Perform dependency installation in a sandbox or least-privileged environment without production credentials. 7. Add automated dependency scanning, lockfile integrity verification, and controlled update review to the release process.