T08 · Insecure Dependencies
Warning
- Location
- scripts/test_publish_api_flow.sh:114
- Finding
- Unpinned Implicit npm Package Retrieval and Execution Through npx## Vulnerability Details **File Location**: `scripts/test_publish_api_flow.sh`, lines 114-115, 140-165, and 181-192 **Vulnerability Type**: Unsafe dependency resolution and execution **Risk Level**: Medium ### Vulnerable Code ```bash if ! command -v npx >/dev/null 2>&1; then error "npx not found." exit 1 fi ``` ```bash if [[ -n "$API_KEY" ]]; then CREATE_OUTPUT="$( cd "$AGENT_SCRIPTS_DIR" PRODUCER_API_BASE_URL="$BASE" PRODUCER_API_KEY="$API_KEY" \ npx tsx create_intent.ts \ --agent-address "$AGENT_ADDRESS" \ --wallet-id "$WALLET_ID" \ --session-cap-id "$SESSION_CAP_ID" \ --recipient "$RECIPIENT" \ --amount-mist "$AMOUNT_MIST" \ --reason "$REASON" \ --ttl-sec "$TTL_SEC" \ --order-id "$ORDER_ID" )" else CREATE_OUTPUT="$( cd "$AGENT_SCRIPTS_DIR" PRODUCER_API_BASE_URL="$BASE" \ npx tsx create_intent.ts \ --agent-address "$AGENT_ADDRESS" \ --wallet-id "$WALLET_ID" \ --session-cap-id "$SESSION_CAP_ID" \ --recipient "$RECIPIENT" \ --amount-mist "$AMOUNT_MIST" \ --reason "$REASON" \ --ttl-sec "$TTL_SEC" \ --order-id "$ORDER_ID" )" fi ``` ```bash if [[ -n "$API_KEY" ]]; then ( cd "$AGENT_SCRIPTS_DIR" PRODUCER_API_BASE_URL="$BASE" PRODUCER_API_KEY="$API_KEY" \ npx tsx e2e_runner.ts --once --poll-ms "$POLL_MS" ) else ( cd "$AGENT_SCRIPTS_DIR" PRODUCER_API_BASE_URL="$BASE" \ npx tsx e2e_runner.ts --once --poll-ms "$POLL_MS" ) fi ``` ### Technical Analysis The script invokes `npx tsx` without requiring a locally installed, reviewed version of `tsx`. By default, `npx` can retrieve a missing package from the configured npm registry and ...[truncated 1652 chars]
- Remediation
- ## Remediation Suggestions 1. Add a package manifest and lockfile that pin an explicitly reviewed `tsx` version. 2. Install dependencies in a separate controlled step using a lockfile-enforcing command such as `npm ci`. 3. Invoke the local binary directly, for example: ```bash "$REPO_ROOT/node_modules/.bin/tsx" create_intent.ts ``` 4. Alternatively, use `npx --no-install tsx` so execution fails rather than downloading an absent package. 5. Enforce dependency integrity and provenance checks in CI. 6. Run the test harness in a restricted environment with only the minimum required files and environment variables. 7. Avoid exposing the API key to dependency tooling unnecessarily; provide it only to the reviewed application process after dependency resolution is complete.