T08 · Insecure Dependencies
- Location
package.json:6- Finding
Unpinned Runtime Dependency and Missing Lockfile
- Content
View full analysis
Vulnerability Details
File Location:
package.json, line 6
Vulnerability Type: Insecure third-party dependency management
Risk Level: MediumVulnerable Code
json { "name": "api3-data-feed-explorer", "version": "1.0.0", "type": "module", "dependencies": { "@api3/dapi-management": "latest", "ethers": "^6.16.0" } }The project also contains no dependency lockfile.
Technical Analysis
The runtime dependency
@api3/dapi-managementuses the mutablelatestversion selector. Consequently, each installation may resolve to a different, previously unaudited package release. The lack of a lockfile further prevents reproducible dependency resolution and integrity verification across installations.The scripts directly import and execute this dependency. It provides contract bindings, chain and RPC metadata, dAPI configuration, data-feed identifiers, and address-derivation functionality. Therefore, a future compromised or malicious release could execute code with the privileges of the user running the Skill, alter endpoint metadata, falsify displayed results, or redirect network requests.
This finding does not establish that the current published dependency is malicious. The vulnerability is the project's unsafe trust and update model.
Attack Path
- An attacker compromises the dependency publisher, registry account, package release process, or another component capable of publishing a new
@api3/dapi-managementversion. - The attacker publishes a malicious version selected by the
latesttag. - A user or Agent installs the Skill's dependencies without a frozen, reviewed lockfile.
- The package manager resolves
@api3/dapi-managementto the attacker-controlled release. - Malicious installation hooks, module initialization logic, or exported functionality executes when installed or imported by the scripts.
- The payload runs with the local privileges and network access of the user or Agent process.
I
...[truncated 567 chars]
- An attacker compromises the dependency publisher, registry account, package release process, or another component capable of publishing a new
- Remediation
View remediation
Remediation Suggestions
- Replace
latestwith a reviewed exact version, without range operators:json "@api3/dapi-management": "REVIEWED_EXACT_VERSION" - Consider pinning
ethersto an exact reviewed version as well to maximize reproducibility. - Generate and commit the package-manager lockfile, including resolved versions and integrity hashes.
- Install dependencies using a frozen-lockfile mode in local automation and CI, such as:
bash pnpm install --frozen-lockfile - Configure dependency update automation to submit explicit, reviewable changes rather than silently consuming new releases.
- Review release provenance, package ownership, lifecycle scripts, transitive dependency changes, and integrity information before accepting upgrades.
- Run installation and scripts in a least-privileged sandbox with restricted filesystem access, no unnecessary secrets in the environment, and outbound network access limited to required public endpoints.
- Replace