T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:7
- Finding
- Execution of an Unpinned npm Package Through a Mutable Latest Tag<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:7`, `SKILL.md:12-20`, `SKILL.md:26`, `SKILL.md:44`, `SKILL.md:68-69`, `SKILL.md:86-89`, `SKILL.md:96-106`, and `SKILL.md:113` **Vulnerability Type**: Supply-chain risk caused by runtime execution of an unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: ["Bash(npx @openant-ai/cli@latest wallet *)", "Bash(npx @openant-ai/cli@latest status*)"] ``` ```markdown Use the `npx @openant-ai/cli@latest` CLI to query your wallet addresses and on-chain balances. ```bash npx @openant-ai/cli@latest status --json ``` ```bash npx @openant-ai/cli@latest wallet addresses --json ``` ```bash npx @openant-ai/cli@latest wallet balance --json ``` ```bash npx @openant-ai/cli@latest wallet balance --solana-rpc https://api.mainnet-beta.solana.com --json npx @openant-ai/cli@latest wallet balance --evm-rpc https://mainnet.base.org --json ``` ``` ### Technical Analysis The skill authorizes and repeatedly instructs the agent to run `npx @openant-ai/cli@latest`. The npm `latest` tag is mutable and does not identify a specific reviewed package version. Depending on the local npm cache and configuration, `npx` can retrieve the currently published package and execute its lifecycle or CLI code at invocation time. As a result, the effective executable can change after this skill has been reviewed without any modification to `SKILL.md`. The skill provides neither an exact version pin nor integrity verification. Although the documented wallet commands are read-only, that restriction applies only to the intended CLI interface and does not constrain arbitrary code contained in a compromised package release. No evidence establishes that the current package is malicious. The vulnerability is the unsafe dependency acquisition and execution model, which exposes users to a future compromised maintainer account, malicious release, or npm supply-chain incident. ### Attack Path 1. An att ...[truncated 1528 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed version, for example: ```bash npx --yes @openant-ai/cli@1.2.3 wallet balance --json ``` 2. Prefer installing the approved package during a controlled build or deployment stage instead of downloading executable code at skill invocation time. 3. Commit a lockfile and verify package integrity through npm integrity hashes or an equivalent trusted artifact-verification mechanism. 4. Review the exact package release, its transitive dependencies, CLI entry point, and lifecycle scripts before approval. 5. Update the `allowed-tools` declaration so it permits only the pinned executable version and the required read-only subcommands. 6. Disable or reject unexpected npm lifecycle scripts where operationally possible, and execute the CLI in a sandbox with: - Minimal filesystem access. - No unnecessary environment secrets. - Restricted outbound network access. - No elevated operating-system privileges. 7. Establish a controlled upgrade process in which version changes require dependency review, integrity verification, and security testing before deployment. ]]>