T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned Third-Party Package Exposes Exchange Credentials to Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 13–16 **Vulnerability Type**: Unpinned executable dependency **Risk Level**: Medium ### Complete Code Snippet ```yaml install: - kind: node package: "@3rd-eye-labs/openmm" bins: [openmm] ``` The package is installed without an exact version or integrity hash. The resulting `openmm` executable operates in an environment containing high-value exchange credentials documented elsewhere in `SKILL.md`, including API keys, secrets, a UID, and a passphrase. ### Technical Analysis The dependency declaration resolves a mutable version of `@3rd-eye-labs/openmm`. Because the project contains neither the package source nor a lockfile or integrity constraint, the installed implementation cannot be verified from the audited artifact. An attacker who compromises the package publisher account, registry distribution path, or a subsequently selected package release could introduce malicious installation or runtime behavior. npm lifecycle scripts may execute during installation, while the installed CLI may access inherited environment variables when invoked. This creates a supply-chain trust boundary around credentials used for MEXC, Gate.io, Bitget, and Kraken. The audit found no evidence that the package is currently malicious. The vulnerability is the absence of reproducible, integrity-verified dependency resolution combined with the dependency's access to sensitive exchange credentials. ### Attack Path 1. An attacker compromises the package publisher, registry account, or package distribution process. 2. The attacker publishes a malicious release under the legitimate package name. 3. A new Skill installation resolves the unpinned dependency to that release. 4. Malicious code executes through an installation lifecycle hook or when an agent invokes the `openmm` binary. 5. The code reads exchange API keys, secrets, UID, or passphrase values from inherited environment variables. 6. The attacker exfilt ...[truncated 845 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@3rd-eye-labs/openmm` to a reviewed, exact version rather than using mutable dependency resolution. 2. Enforce package integrity with a committed lockfile and verified registry integrity hashes. 3. Audit or vendor the exact package source, including npm lifecycle scripts and transitive dependencies. 4. Disable installation scripts where operationally feasible, such as with `npm install --ignore-scripts`. 5. Install and execute the CLI in a sandbox with restricted filesystem, network, and process permissions. 6. Expose credentials only to the specific process that needs them rather than broadly exporting them into an agent environment. 7. Use separate, read-only, least-privilege API keys for portfolio queries. 8. Disable trading, withdrawal, transfer, and account-management permissions unless explicitly required. 9. Apply exchange-supported IP allowlists and rotate credentials after any suspected dependency compromise. 10. Add automated dependency provenance, vulnerability, and unexpected-release monitoring.