T08 · Insecure Dependencies
Warning
- Location
references/guides/scripts.md:5- Finding
Unpinned Third-Party Packages Are Downloaded and Executed at Runtime
- Content
View full analysis
bun script.mjs` to resolve packages at runtime. All scripts are in `skills/superfluid/scripts/`. --- ## ABI JSON — `abi.mjs` Source: [`@sfpro/sdk`](https://sdk.superfluid.pro/docs) package. ``` bunx -p @sfpro/sdk bun abi.mjs Full JSON ABI bunx -p @sfpro/sdk bun abi.mjs Single fragment by name bunx -p @sfpro/sdk bun abi.mjs list All contracts with SDK import info ``` ``` The same pattern is used for other dependencies, including: ```bash bunx -p @superfluid-finance/tokenlist bun tokenlist.mjs ... bunx -p @superfluid-finance/metadata bun metadata.mjs ... bunx -p @sfpro/sdk -p js-sha3 bun selectors.mjs ... bunx @foundry-rs/cast ``` ### Technical Analysis The Skill explicitly directs users or agents to use `bunx` to resolve packages from a public package registry at execution time. No exact package versions, lockfile, integrity hashes, or immutable package artifacts are specified. The scripts then import code from those downloaded packages, for example: ```javascript import { extendedSuperTokenList } from "@superfluid-finance/tokenlist"; import metadata from "@superfluid-finance/metadata"; import { keccak256 } from "js-sha3"; ``` Consequently, the code that runs is not limited to the content reviewed in this Skill. Package initialization code and transitive dependencies may execute with the permissions of the invoking user. The effec ...[truncated 1957 chars]- Remediation
View remediation