T08 · Insecure Dependencies
Warning
- Location
- references/clanker.md:14
- Finding
- Unpinned Third-Party Packages Installed in Wallet-Enabled Applications<![CDATA[ ## Vulnerability Details **File Locations**: - `references/clanker.md:14` - `references/flaunch.md:14` - `references/pumpfun.md:14` **Vulnerability Type**: Supply-chain exposure through mutable dependency versions **Risk Level**: Medium ### Vulnerable Code `references/clanker.md:14`: ```bash npm install clanker-sdk viem ``` `references/flaunch.md:14`: ```bash npm install viem ``` `references/pumpfun.md:14`: ```bash npm install @solana/web3.js @solana/spl-token ``` ### Technical Analysis The setup commands install the latest package versions available at execution time without exact version or integrity pinning. Consequently, the dependency code installed by two users at different times may differ from the code reviewed during this audit. These packages are intended to run inside applications that load blockchain transaction-signing keys and construct or submit financial transactions. A malicious or compromised package release could therefore operate within a security-sensitive process. Although `REFERENCE.md` recommends auditing third-party SDKs and pinning versions, the actual installation examples do not enforce those controls. The finding does not establish that the named packages are currently malicious. The vulnerability is the unsafe, mutable dependency-resolution process documented by the Skill. ### Attack Path 1. An attacker compromises a listed package, one of its transitive dependencies, or a maintainer account. 2. The attacker publishes a malicious release under the legitimate package name. 3. A user follows one of the documented unversioned `npm install` commands. 4. npm resolves the dependency to the compromised release. 5. The package executes in an application that has access to a launch-wallet key and RPC connectivity. 6. The malicious code reads signing material, changes transaction calldata or recipients, or submits unauthorized transactions. 7. The attacker steals the minimally funded wallet balance, redirects creator f ...[truncated 806 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace all unversioned package commands with exact, reviewed versions, for example: ```bash npm install --save-exact clanker-sdk@REVIEWED_VERSION viem@REVIEWED_VERSION ``` 2. Generate and commit `package-lock.json`, and use `npm ci` in automated and production environments. 3. Pin direct dependencies and review transitive dependency changes before updating the lockfile. 4. Verify npm package ownership, provenance, integrity hashes, repository links, and release history. 5. Run dependency scanning and lockfile-diff review in CI. 6. Disable unnecessary lifecycle scripts where operationally possible, or review package lifecycle scripts before installation. 7. Isolate wallet-signing functionality in a least-privileged process with only the required secrets and network access. 8. Continue using a dedicated, minimally funded launch wallet, and rotate it immediately if dependency compromise is suspected. ]]>