T08 · Insecure Dependencies
Error
- Location
- tools.json:22
- Finding
- Unpinned npm Package Is Executed Through npx## Vulnerability Details **File Location**: `tools.json:19-27` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```json "subscription": { "price": "1 SOL", "duration": "30 days", "cli": "npx whistle-rpc subscribe", "endpoints": { "quote": "POST https://api.whistle.ninja/api/agent/subscribe", "activate": "POST https://api.whistle.ninja/api/agent/activate", "status": "GET https://api.whistle.ninja/api/agent/status/:apiKey" } } ``` The same unversioned CLI is advertised in `CHANGELOG.md:11`: ```markdown - CLI: npx whistle-rpc ``` ### Technical Analysis The command `npx whistle-rpc subscribe` does not specify an exact package version or integrity value. If the package is absent locally, `npx` can retrieve it from the configured npm registry and execute its exposed CLI. The artifact under review does not include the CLI source, a lockfile, an integrity hash, or another mechanism that binds execution to an audited package release. Consequently, the code executed by this instruction can change after the skill has been reviewed. A compromised npm maintainer account, compromised package release, registry/configuration manipulation, or malicious future package version could cause arbitrary package code to run. Depending on the npm configuration and package contents, execution may include package lifecycle behavior as well as the requested CLI entry point. ### Attack Path 1. An attacker compromises the `whistle-rpc` npm package, its publisher account, or the registry resolution path. 2. The attacker publishes or serves a malicious version that is selected by the unversioned package reference. 3. A user or agent follows the documented subscription procedure and runs `npx whistle-rpc subscribe`. 4. `npx` downloads the currently resolved package because no audited version is pinned. 5. The malicious package executes with the permis ...[truncated 769 chars]
- Remediation
- ## Remediation Suggestions - Replace the unversioned invocation with an exact, reviewed version, such as `npx --yes whistle-rpc@1.0.0 subscribe`, after independently auditing that release. - Prefer installing the dependency through a committed lockfile and invoking the locked local binary rather than downloading code at execution time. - Verify npm package integrity through lockfile integrity metadata, trusted provenance, and publisher/signature controls. - Run the CLI in a sandbox or container with minimal filesystem access, no unrelated secrets, and a dedicated low-value wallet. - Disable package lifecycle scripts where compatible, for example by using an npm configuration with `ignore-scripts=true`. - Document the expected package publisher, checksum, supported version, and verification procedure. - Require explicit operator approval before any installation or execution of code retrieved from a package registry.