T08 · Insecure Dependencies
Warning
- Location
- setup.sh:20
- Finding
- Unpinned Third-Party Dependencies Create a Supply-Chain Risk## Vulnerability Details **File Location**: `setup.sh`, lines 20-22 **Vulnerability Type**: Unpinned dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # Install dependencies echo "📦 Installing dependencies..." npm install viem dotenv @circle-fin/developer-controlled-wallets ``` ### Technical Analysis The setup script installs three packages without exact versions. The project also contains no reviewed lockfile or integrity constraints. Consequently, each installation may resolve different package and transitive-dependency versions. This is particularly sensitive because the installed Circle SDK subsequently receives `CIRCLE_API_KEY` and `CIRCLE_ENTITY_SECRET`, while the installed packages execute in a process capable of initiating wallet operations. A compromised package release, compromised transitive dependency, or malicious lifecycle script could execute with the user's local permissions and access secrets available to the setup or runtime process. This finding does not establish that the named packages are malicious. It identifies the absence of reproducible, integrity-controlled dependency resolution. ### Attack Path 1. An attacker compromises a listed package, one of its transitive dependencies, or the associated package publication account. 2. The attacker publishes a malicious version that satisfies the unconstrained installation request. 3. A user follows the documented instructions and runs `bash setup.sh`. 4. `npm install` resolves and installs the attacker-controlled release. 5. Malicious code executes through an installation lifecycle hook or when the dependency is imported. 6. The code may read Circle credentials from the environment or `.env` file, alter wallet API requests, or substitute transaction parameters. 7. The attacker may then use exposed credentials or manipulated wallet operations within the authority granted to the Circle developer-controlled wallet configurat ...[truncated 704 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct dependency to an exact reviewed version rather than using unconstrained package names. 2. Generate and commit a lockfile after reviewing the resolved dependency graph. 3. Replace `npm install` in automated setup with `npm ci` so installation fails if the lockfile and manifest differ. 4. Use package-manager integrity verification and retain the lockfile's integrity hashes. 5. Disable dependency lifecycle scripts where compatible, for example with `npm ci --ignore-scripts`, and explicitly run only required, reviewed build steps. 6. Audit direct and transitive dependencies using vulnerability and provenance tooling. 7. Run setup under a minimally privileged account without wallet credentials in the environment. 8. Make Circle credentials available only to the specific runtime command that requires them. 9. Apply Circle-side least-privilege policies, transaction limits, and monitoring to reduce the impact of a dependency compromise.