T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Mutable npm Package Executed with Cryptocurrency Wallet Authority<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 5, 11, 18–19, and 27 **Vulnerability Type**: Supply-chain risk caused by runtime execution of an unpinned dependency **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: ["Bash(npx @openant-ai/cli@latest wallet send *)", "Bash(npx @openant-ai/cli@latest wallet balance*)", "Bash(npx @openant-ai/cli@latest wallet addr*)", "Bash(npx @openant-ai/cli@latest status*)"] ``` ```markdown Use the `npx @openant-ai/cli@latest` CLI to transfer tokens on Solana or Base. ``` ```bash npx @openant-ai/cli@latest status --json npx @openant-ai/cli@latest wallet balance --json ``` ```bash npx @openant-ai/cli@latest wallet send <chain> <token> <amount> <to> [--json] [--rpc <url>] ``` ### Technical Analysis The Skill directs the agent to execute `@openant-ai/cli@latest` through `npx`. The `latest` npm distribution tag is mutable and does not identify a fixed, previously audited package version. Depending on the local npm cache and configuration, `npx` may retrieve and execute the package at invocation time. Consequently, the effective executable code can change after the Skill has been reviewed. Compromise of the package publisher account, npm package, or upstream dependency chain could cause a future invocation to execute attacker-controlled code. This is particularly sensitive because the CLI operates in an authenticated cryptocurrency-wallet context. It can inspect wallet state and submit irreversible transfers. Although the Skill includes appropriate user-confirmation and address-verification instructions, those procedural controls cannot reliably constrain malicious code inside the CLI itself. A compromised CLI could modify transaction parameters after confirmation, access credentials available to its process, or perform unrelated actions using the process's local permissions. No evidence establishes that the current package is malicious. The vulnerability is the unsafe trust and updat ...[truncated 1754 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, audited package version, for example: ```bash npx --yes @openant-ai/cli@1.2.3 wallet balance --json ``` The example version must be replaced with a real version that has been independently reviewed. 2. Prefer installing the approved package during a controlled deployment or build phase rather than downloading executable code when a wallet operation is requested. 3. Commit and enforce a lockfile with package integrity hashes. Use deterministic installation such as `npm ci` and reject unexpected lockfile changes. 4. Verify package provenance, publisher identity, signatures or attestations, and registry source before approving upgrades. 5. Re-audit each proposed package update and its transitive dependency changes before changing the pinned version. 6. Run the CLI in an isolated environment with the minimum required filesystem, environment-variable, and network access. Do not expose unrelated secrets to the process. 7. Separate read-only wallet operations from transaction-signing authority where supported. Require transaction signing to validate the chain, token, amount, and complete recipient address independently of values returned by the CLI. 8. Add an out-of-band transaction preview or signer-level confirmation that displays the final serialized transaction destination and amount. This helps detect parameter substitution inside a compromised CLI. 9. Restrict network egress to required blockchain RPC and approved OpenAnt endpoints where operationally feasible. 10. Preserve the existing explicit-confirmation, address-validation, balance, and gas-reserve checks, but do not treat them as substitutes for dependency pinning and execution isolation. ]]>