T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Execution of an Unpinned Third-Party CLI Package## Vulnerability Details **File Location**: `SKILL.md`, lines 12 and 19–21 **Vulnerability Type**: Supply-chain risk from a mutable npm package version **Risk Level**: Medium ### Vulnerable Code ```bash npx @openant-ai/cli@latest <command> [options] ``` ```bash npx @openant-ai/cli@latest login # Interactive OTP via email npx @openant-ai/cli@latest whoami --json npx @openant-ai/cli@latest status --json ``` ### Technical Analysis The skill instructs agents to execute `@openant-ai/cli` through `npx` using the mutable `latest` distribution tag. Depending on the local npm configuration and cache state, `npx` can download the selected package and execute its code immediately. Because `latest` does not identify a fixed, reviewed artifact, the code executed can change after this skill has been audited. The project provides no exact package version, lockfile, integrity hash, or provenance-verification procedure. This creates a supply-chain trust boundary in which compromise of the package publisher, npm account, release pipeline, package dependencies, or registry delivery path could replace expected CLI behavior with arbitrary code. The exposure is particularly relevant because the documented CLI is used for authentication and wallet-related operations. ### Attack Path 1. An attacker compromises the npm publisher account, release pipeline, package dependency chain, or another component capable of controlling the package identified by the `latest` tag. 2. The attacker publishes a malicious package release and assigns or causes the `latest` tag to resolve to it. 3. A user or agent follows the skill instructions and invokes `npx @openant-ai/cli@latest`. 4. `npx` retrieves or resolves the attacker-controlled release and executes its package entry point with the invoking user's operating-system privileges. 5. The malicious package can inspect accessible files, environment variables, npm configuration, and OpenAnt configuration or authentication materi ...[truncated 864 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed version, for example `@openant-ai/cli@X.Y.Z`. 2. Prefer installation through a committed `package.json` and lockfile rather than downloading an executable package during each operational invocation. 3. Enforce lockfile integrity in deployment or automation with commands such as `npm ci`. 4. Verify npm package provenance, publisher identity, signatures where available, and registry integrity metadata before approving upgrades. 5. Introduce a controlled dependency-update process that reviews release changes and transitive dependencies before modifying the pinned version. 6. Run the CLI with least privilege in an isolated environment, exposing only the configuration and credentials required for the requested operation. 7. Avoid making wallet secrets or unrelated credentials available to the CLI process, and require explicit user confirmation for state-changing or financial operations.