T08 · Insecure Dependencies
Warning
- Location
SKILL.md:6- Finding
Unpinned Third-Party CLI Is Downloaded and Executed Through npx
- Content
View full analysis
--json npx @openant-ai/cli@latest tasks accept --json npx @openant-ai/cli@latest tasks accept --team --json npx @openant-ai/cli@latest tasks apply --message "I have 3 years of Solana auditing experience. Previously audited Marinade Finance and Raydium contracts." --json npx @openant-ai/cli@latest files list --json npx @openant-ai/cli@latest files download --all --json npx @openant-ai/cli@latest files download --all --output ./task-files/ --json npx @openant-ai/cli@latest files url --all --json ``` ### Technical Analysis `npx` can retrieve and execute an npm package on demand. The `@latest` tag does not identify an immutable, reviewed artifact: its target can change whenever a new version is published. Consequently, the code executed when the skill is invoked may differ from the code that existed when the skill was audited. The project contains no exact package version, dependency lockfile, integrity hash, or documented provenance-verification mechanism. The affected CLI is used for authenticated OpenAnt operations, remote state changes, and downloading externally supplied files. Any package lifecycle behavior and transitive dependencies execute with the privileges and environment inherited from ...[truncated 1671 chars]- Remediation
View remediation
status --json ``` 2. Prefer installing the dependency through a committed lockfile that records package and transitive-dependency integrity metadata. Execute the locked local binary instead of resolving a package dynamically for every invocation. 3. Verify npm package provenance, publisher identity, release signatures or attestations, and integrity information before approving an update. 4. Establish a controlled update process: - Review release changes and dependency-tree differences. - Scan the new artifact and its transitive dependencies. - Test it in an isolated environment. - Update the pinned version and lockfile only after approval. 5. Run the CLI in a sandbox or restricted subprocess with only the filesystem paths, environment variables, credentials, and network destinations required for OpenAnt operations. 6. Avoid exposing unrelated secrets to the CLI process. Supply narrowly scoped OpenAnt credentials at execution time and rotate them if a dependency compromise is suspected. 7. Restrict downloaded files to a dedicated directory and treat their contents as untrusted, particularly before opening or executing them. ]]>