T08 · Insecure Dependencies
- Location
README.md:6- Finding
Unpinned Third-Party npm Package Is Downloaded and Executed Without Verifiable Source
- Content
View full analysis
Vulnerability Details
File Location:
README.md:6-11
Vulnerability Type: Unverified and unpinned third-party dependency execution
Risk Level: Mediumbash npm install -g @cyberdrk/onchainOr run directly with npx:
bash npx @cyberdrk/onchain price btcTechnical Analysis
The documented installation methods download and execute the current registry release of
@cyberdrk/onchainwithout specifying an exact version or verifying an integrity hash. The supplied project contains only documentation and does not include the CLI source code,package.json, a lockfile, checksums, or other materials needed to audit the installed package.npm install -gcan execute npm lifecycle scripts and persist a globally available executable. Thenpxalternative can retrieve and immediately execute package code. Consequently, the code executed by users or agents can differ from the content reviewed in this project and may change whenever a new package version is published.The exposure is particularly sensitive because
SKILL.md:8-18instructs users to configure credentials for Coinbase, Binance, DeBank, and Helius. Once configured, the unaudited executable may be able to access those credentials and make authenticated requests using the permissions assigned to them.Attack Path
- A user or AI agent follows the installation instructions in
README.md. - npm resolves the latest available release of
@cyberdrk/onchainrather than a fixed, previously reviewed artifact. - The downloaded package and any applicable lifecycle scripts execute with the permissions of the invoking user.
- The user follows the setup instructions and supplies exchange or provider API credentials.
- If the npm publisher account, registry artifact, dependency tree, or future package release is compromised, malicious code can read accessible configuration and environment data.
- The malicious package can transmit expos ...[truncated 897 chars]
- A user or AI agent follows the installation instructions in
- Remediation
View remediation
Remediation Suggestions
- Include the CLI source code and complete package metadata in the reviewed project so its behavior can be audited.
- Pin installation instructions to an exact, security-reviewed package version instead of allowing npm to resolve the latest release.
- Publish and document a cryptographic integrity value for the reviewed package artifact, and require verification before execution.
- Commit a lockfile and use reproducible release procedures to constrain transitive dependencies.
- Avoid recommending automatic
npxexecution of an unverified remote package. Prefer a locally verified artifact or a controlled installation process. - Review and minimize npm lifecycle scripts. Where operationally feasible, install with lifecycle scripts disabled and explicitly execute only required build steps.
- Store credentials using an operating-system credential manager or similarly protected secret store rather than an ordinary plaintext configuration file.
- Require least-privilege API credentials. Exchange keys should be read-only, with trading, transfer, and withdrawal permissions disabled unless strictly necessary.
- Document package provenance, release signing, maintainer controls, and a process for responding to compromised npm releases.