T08 · Insecure Dependencies
- Location
SKILL.md:12- Finding
Execution of an Unpinned Third-Party CLI Package
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 12 and 19–21
Vulnerability Type: Supply-chain risk from a mutable npm package version
Risk Level: MediumVulnerable Code
bash npx @openant-ai/cli@latest <command> [options]bash npx @openant-ai/cli@latest login # Interactive OTP via email npx @openant-ai/cli@latest whoami --json npx @openant-ai/cli@latest status --jsonTechnical Analysis
The skill instructs agents to execute
@openant-ai/clithroughnpxusing the mutablelatestdistribution tag. Depending on the local npm configuration and cache state,npxcan download the selected package and execute its code immediately.Because
latestdoes not identify a fixed, reviewed artifact, the code executed can change after this skill has been audited. The project provides no exact package version, lockfile, integrity hash, or provenance-verification procedure. This creates a supply-chain trust boundary in which compromise of the package publisher, npm account, release pipeline, package dependencies, or registry delivery path could replace expected CLI behavior with arbitrary code.The exposure is particularly relevant because the documented CLI is used for authentication and wallet-related operations.
Attack Path
- An attacker compromises the npm publisher account, release pipeline, package dependency chain, or another component capable of controlling the package identified by the
latesttag. - The attacker publishes a malicious package release and assigns or causes the
latesttag to resolve to it. - A user or agent follows the skill instructions and invokes
npx @openant-ai/cli@latest. npxretrieves or resolves the attacker-controlled release and executes its package entry point with the invoking user's operating-system privileges.- The malicious package can inspect accessible files, environment variables, npm configuration, and OpenAnt configuration or authentication materi ...[truncated 864 chars]
- An attacker compromises the npm publisher account, release pipeline, package dependency chain, or another component capable of controlling the package identified by the
- Remediation
View remediation
Remediation Suggestions
- Replace
@latestwith an exact, reviewed version, for example@openant-ai/cli@X.Y.Z. - Prefer installation through a committed
package.jsonand lockfile rather than downloading an executable package during each operational invocation. - Enforce lockfile integrity in deployment or automation with commands such as
npm ci. - Verify npm package provenance, publisher identity, signatures where available, and registry integrity metadata before approving upgrades.
- Introduce a controlled dependency-update process that reviews release changes and transitive dependencies before modifying the pinned version.
- Run the CLI with least privilege in an isolated environment, exposing only the configuration and credentials required for the requested operation.
- Avoid making wallet secrets or unrelated credentials available to the CLI process, and require explicit user confirmation for state-changing or financial operations.
- Replace