T08 · Insecure Dependencies
- Location
package.json:38- Finding
Unaudited Local Dependency Outside the Project Boundary
- Content
View full analysis
Vulnerability Details
File Location:
package.json:36-45; installation is directed byREADME.md:13-18,README.md:24-29, andSKILL.md:10-13
Vulnerability Type: T08: Insecure Dependencies
Risk Level: MediumThe dependency configuration includes a package resolved from a sibling directory outside the audited project:
json "dependencies": { "@circle-fin/developer-controlled-wallets": "^10.1.0", "@circle/openclaw-wallet-skill": "file:../skills/circle-wallet", "@types/uuid": "^10.0.0", "axios": "^1.13.4", "commander": "^14.0.3", "dotenv": "^17.2.3", "node-forge": "^1.3.3", "uuid": "^13.0.0" }Users are instructed to install these dependencies:
bash npm install npm run buildTechnical Analysis
The
file:../skills/circle-walletdependency crosses the audited artifact boundary and loads a package from the local environment. The referenced sibling package was not included in the supplied project, so its source code, package metadata, and npm lifecycle scripts could not be reviewed.During
npm install, npm may execute lifecycle scripts declared by dependencies. If the sibling directory contains an attacker-controlled package, its installation scripts can execute with the privileges of the user running npm. The absence of a committed lockfile also means registry dependencies specified with caret ranges may resolve to different permitted versions over time, reducing build reproducibility and increasing supply-chain exposure.No evidence establishes that the referenced package or registry dependencies are currently malicious. The risk arises from trusting unaudited, environment-dependent dependency content during the documented installation procedure.
Attack Path
- An attacker gains the ability to create or modify
../skills/circle-walletrelative to the KarmaBank package directory. - The attacker supplies a valid npm package at that location and ...[truncated 1206 chars]
- An attacker gains the ability to create or modify
- Remediation
View remediation
Remediation Suggestions
- Include the wallet dependency inside the reviewed repository or replace the relative
file:dependency with a trusted, published package pinned to an exact version. - Audit the dependency's source code and all npm lifecycle scripts before installation.
- Commit an npm lockfile containing exact dependency resolutions and integrity hashes, and use
npm cifor reproducible installations. - Pin security-sensitive dependencies to reviewed versions instead of relying only on mutable caret ranges.
- Run installation with lifecycle scripts disabled, such as
npm ci --ignore-scripts, unless particular scripts are documented and required. - Perform dependency installation in a sandbox or least-privileged environment without production credentials.
- Add automated dependency scanning, lockfile integrity verification, and controlled update review to the release process.
- Include the wallet dependency inside the reviewed repository or replace the relative