T08 · Insecure Dependencies
Warning
- Location
- skill.md:128
- Finding
- Unpinned Third-Party Dependency Creates Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `skill.md:128` **Vulnerability Type**: Unpinned package installation **Risk Level**: Medium ### Vulnerable Code ```bash npm install ethers WALLET_KEY=0xYourPrivateKey node kelp-agent.mjs ``` ### Technical Analysis The installation command does not specify an exact reviewed version of `ethers`, and the project does not provide a lockfile or integrity metadata. Consequently, users may install different package versions depending on when the instructions are executed. Because the installed dependency runs in the same environment as code that accesses `WALLET_KEY` and signs blockchain transactions, a compromised package release, registry account, transitive dependency, or package installation mechanism could access sensitive wallet material or modify transaction behavior. The available project evidence does not establish that the current `ethers` package is malicious; the weakness is the uncontrolled and mutable dependency resolution process. ### Attack Path 1. An attacker compromises a relevant package publication account, dependency, or package registry delivery path. 2. The attacker publishes or serves a malicious version that remains compatible with the unrestricted installation command. 3. A user follows the documented `npm install ethers` instruction. 4. The malicious package or dependency executes installation-time code or is imported by the agent script. 5. The package reads `WALLET_KEY`, alters provider or contract behavior, or changes transaction parameters before signing. 6. The attacker obtains the wallet key or causes the user to authorize attacker-controlled blockchain transactions. ### Impact Assessment Successful exploitation could expose the wallet private key and provide full signing authority over the affected wallet. This could allow theft of native assets and tokens, unauthorized approvals, malicious contract interactions, or transfer of NFTs. The scope is limited to environments t ...[truncated 98 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `ethers` to a reviewed exact version rather than using an unconstrained installation: ```bash npm install --save-exact ethers@<reviewed-version> ``` 2. Include a reviewed `package.json` and lockfile in the project. 3. Direct users to install dependencies with: ```bash npm ci ``` 4. Verify and review the resolved dependency tree before distribution. 5. Use package integrity controls and a trusted registry. 6. Disable package lifecycle scripts where they are unnecessary: ```bash npm ci --ignore-scripts ``` 7. Run wallet-signing software in a restricted environment and prefer an external or hardware signer so that dependencies cannot directly read raw private keys. ]]>