T08 · Insecure Dependencies
Warning
- Location
- references/clanker.md:16
- Finding
- Unpinned Security-Critical Blockchain Dependencies## Vulnerability Details **File Location**: `references/clanker.md:16`, `references/flaunch.md:16`, and `references/pumpfun.md:16` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Complete Code Snippets `references/clanker.md:16`: ```bash npm install clanker-sdk viem ``` `references/flaunch.md:16`: ```bash npm install viem ``` `references/pumpfun.md:16`: ```bash npm install @solana/web3.js @solana/spl-token ``` ### Technical Analysis These installation commands do not specify exact dependency versions or integrity constraints. Consequently, npm resolves mutable package versions available at installation time rather than a release that was explicitly audited by the project. This is particularly sensitive because the referenced packages construct blockchain transactions, interact with RPC services, and may receive access to funded signing wallets. A malicious, compromised, or unexpectedly incompatible dependency release could alter transaction calldata, destination contracts, fee-recipient addresses, or signing and submission behavior. The installation guidance also conflicts with the recommendation in `REFERENCE.md:37` to pin package versions. The repository contains no implementation lockfile that would make these example installations reproducible. ### Attack Path 1. A developer follows one of the documented `npm install` commands. 2. npm resolves the latest package release and its transitive dependency graph. 3. An upstream package or transitive dependency has been compromised, maliciously replaced, or published with unsafe behavior. 4. The developer imports the package into an application that has RPC connectivity and access to a dedicated funded signing wallet. 5. The compromised dependency changes transaction destinations, calldata, fee-recipient configuration, or transaction submission behavior. 6. The application signs or submits the manipulated transact ...[truncated 761 chars]
- Remediation
- ## Remediation Suggestions 1. Replace each installation command with exact, reviewed package versions, for example `package-name@x.y.z`. 2. Provide a minimal reference implementation with a committed `package-lock.json`. 3. Instruct users to install reproducibly with `npm ci` rather than resolving mutable versions with an unconstrained `npm install`. 4. Verify package provenance, maintainers, registry source, and integrity metadata before approving dependency updates. 5. Review transitive dependencies and use automated supply-chain scanning, such as lockfile auditing and dependency alerts. 6. Apply dependency updates deliberately after reviewing release changes and testing transaction destinations, calldata, fee recipients, and signing behavior. 7. Continue using dedicated wallets with minimal balances and require transaction simulation plus human verification of destination addresses and fee-recipient configuration before signing.