T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Mutable, Unreviewed npm Dependency Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 14–17 and 31–34 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml requires: bins: - node - npx install: "npm install -g @0xwork/cli@latest" ``` ```markdown - CLI package: `@0xwork/cli@1.7.3` - SDK package: `@0xwork/sdk@0.6.5` - Install: `npm install -g @0xwork/cli@latest` - One-off usage: `npx -y @0xwork/cli@latest <command>` ``` ### Technical Analysis The installation and one-off execution instructions resolve the mutable npm `latest` tag instead of an exact, reviewed package version. The `npx -y` command can download and execute whichever release currently owns that tag without requesting interactive approval. This conflicts with the document's reference to the concrete CLI version `1.7.3` and makes execution non-reproducible. The executable dependency is not included in the audited project, which contains only documentation, so its implementation and effective runtime behavior could not be inspected. The risk is elevated because the CLI is intended to receive wallet and API credentials and perform asset-moving operations. A compromised npm account, malicious new release, altered tag, or upstream package compromise could therefore turn an otherwise legitimate command into arbitrary code execution under the agent's local privileges. ### Attack Path 1. An attacker compromises the npm package publisher, publishing pipeline, or another relevant supply-chain component. 2. The attacker publishes a malicious release and assigns it to the `latest` tag. 3. A user or agent follows the documented global installation command or runs the unattended `npx -y` command. 4. npm resolves and executes the attacker-controlled package rather than the version referenced during review. 5. The malicious package runs with the invoking process's permissions and can inspect accessible environment variables and files. 6. If signing credentials are ...[truncated 1064 chars]
- Remediation
- ## Remediation Suggestions 1. Replace all `@latest` references with an exact version that has been reviewed, such as `@0xwork/cli@1.7.3`, provided that version is independently verified. 2. Keep the declared package version and every installation example consistent. 3. Install the dependency locally through a committed lockfile rather than globally, and use `npm ci` to enforce locked resolution. 4. Verify package provenance and integrity through registry signatures, trusted publishing metadata, and pinned integrity hashes where supported. 5. Avoid unattended `npx -y` execution for software capable of accessing signing credentials or moving assets. 6. Run the CLI with a minimal environment that exposes only credentials required for the specific operation. 7. Apply Bankr IP allowlisting, trusted-recipient restrictions, and contract restrictions as described by the project. 8. Use a dedicated low-value wallet with narrowly scoped authority and transaction limits. 9. Review dependency changes before upgrades and require explicit approval to update the pinned version. 10. Execute the CLI in a sandbox or isolated account with restricted filesystem and network access where operationally feasible.