T08 · Insecure Dependencies
Error
- Location
scripts/biglog.js:34- Finding
Private Key Exposed to an Unpinned External Sibling Module
- Content
View full analysis
{ try { const sol = require(require('path').join(__dirname, '..', '..', 'turing-pot', 'scripts', 'solana-lite.js')); const kp = sol.keypairFromSecretKey(pk); return `AI.OC.${kp.publicKeyB58.slice(0, 16)}`; } catch { return 'AI.OC.BIGLOG.QUERY.001'; } })() : 'AI.OC.BIGLOG.QUERY.001'; } ``` ### Technical Analysis When `TURING_POT_PRIVATE_KEY` is present and no explicit `--user-token` is supplied, the CLI dynamically loads JavaScript from: ```text ../../turing-pot/scripts/solana-lite.js ``` This module is outside the audited package, is not declared in `package.json`, and is not version-pinned or integrity-checked. The CLI then passes the raw private key directly to the module's `keypairFromSecretKey` function. Node.js modules execute arbitrary code during `require()`, before the requested function is called. Consequently, anyone who can replace or influence the sibling `turing-pot` installation can execute code in the CLI process and access the private key. The external module can also retain, write, or transmit the key using the process's filesystem and network permissions. The broad `catch` block only changes the fallback token. It cannot reverse disclosure or side effects that occur while loading the module or processing the key. ### Attack Path 1. A user installs or updates a sibling `turing-pot` Skill at the path expected by this package. 2. An attacker compromises, replaces, or otherwise controls `turing-pot/scripts/solana-lite.js`. 3. The user exports `TURING_POT_PRIVATE_KEY` and invokes `scripts/biglog.js` without `--us ...[truncated 939 chars]- Remediation
View remediation