T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:49
- Finding
- Unpinned Third-Party CLI Installed Globally with Access to Wallet Keys and Transaction Signing<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:49-52` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @graveyardprotocol/gp-cli ``` ### Technical Analysis The Skill instructs users or agents to globally install `@graveyardprotocol/gp-cli` without specifying an exact version or verifying a package integrity hash. Consequently, installation resolves to whichever package version the npm registry serves at execution time rather than the version reviewed when the Skill was published. This dependency is security-sensitive because the documented workflow gives it access to Solana keypair files, encrypted wallet storage, local transaction signing, and network communication with the Graveyard Protocol backend. The relevant package implementation, lockfile, and integrity metadata are not included in the audited artifact, so the claims that private keys remain local and transactions are constructed safely cannot be independently verified from this project. Global installation also increases scope: the executable is placed in a shared command search path and may remain available after the Skill operation ends. This is broader than a project-local, version-pinned installation. No evidence in `SKILL.md` proves that the current npm package is malicious or that private keys are currently transmitted. The vulnerability is the unsafe and mutable dependency acquisition mechanism combined with the dependency's highly sensitive wallet privileges. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry delivery path, or another component used by `@graveyardprotocol/gp-cli`. 2. The attacker publishes a modified package under the same package name and a version selected by the unpinned installation command. 3. An agent or user follows the Skill and executes: ```bash npm install -g @graveyardprotocol/gp-cli ``` 4. npm i ...[truncated 1724 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact, security-reviewed version: ```bash npm install --save-exact @graveyardprotocol/gp-cli@1.2.2 ``` Do not use version ranges or implicitly install the latest release. 2. Prefer a project-local installation over a global installation: ```bash npm install --save-exact @graveyardprotocol/gp-cli@1.2.2 npx --no-install gp ... ``` This limits command-path exposure and makes dependency state easier to inspect. 3. Commit and enforce a lockfile containing registry resolution and integrity metadata. Use `npm ci` rather than mutable installation commands in automated environments. 4. Verify package provenance, signatures, and published integrity before installation. Pin the expected package digest in the Skill or a trusted deployment manifest. 5. Include or vendor the reviewed CLI source in the audited project, or link the exact immutable source commit corresponding to the installed package version. Confirm that the npm artifact reproducibly matches that source. 6. Disable npm lifecycle scripts during installation unless they are reviewed and required: ```bash npm ci --ignore-scripts ``` If lifecycle scripts are necessary, audit them explicitly before allowing execution. 7. Run the CLI in a restricted environment with access only to the required keypair file, wallet directory, and approved backend domain. Avoid exposing unrelated credentials or home-directory content. 8. Require `--dry-run` and explicit user approval before each state-changing transaction. Do not default to unattended `--all --yes` operations for wallets holding meaningful value. 9. Display and independently validate complete transaction details before signing, including instructions, account permissions, recipients, protocol fees, and reclaimed amounts. 10. Document package update and incident-response procedures, including revocation or migration of any wallet whose keypair was exposed to an ...[truncated 26 chars]