T08 · Insecure Dependencies
Warning
- Location
- references/guides/scripts.md:5
- Finding
- Unpinned Third-Party Packages Are Downloaded and Executed at Runtime< package. ``` bunx -p @sfpro/sdk bun abi.mjs <contract> Full JSON ABI bunx -p @sfpro/sdk bun abi.mjs <contract> <function> Single fragment by name bunx -p @sfpro/sdk bun abi.mjs list All contracts with SDK import info ``` ``` The same pattern is used for other dependencies, including: ```bash bunx -p @superfluid-finance/tokenlist bun tokenlist.mjs ... bunx -p @superfluid-finance/metadata bun metadata.mjs ... bunx -p @sfpro/sdk -p js-sha3 bun selectors.mjs ... bunx @foundry-rs/cast ``` ### Technical Analysis The Skill explicitly directs users or agents to use `bunx` to resolve packages from a public package registry at execution time. No exact package versions, lockfile, integrity hashes, or immutable package artifacts are specified. The scripts then import code from those downloaded packages, for example: ```javascript import { extendedSuperTokenList } from "@superfluid-finance/tokenlist"; import metadata from "@superfluid-finance/metadata"; import { keccak256 } from "js-sha3"; ``` Consequently, the code that runs is not limited to the content reviewed in this Skill. Package initialization code and transitive dependencies may execute with the permissions of the invoking user. The effec ...[truncated 1957 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin every runtime dependency to an exact audited version.** ```bash bunx -p @sfpro/sdk@1.2.3 bun abi.mjs ... bunx -p @superfluid-finance/tokenlist@1.2.3 bun tokenlist.mjs ... bunx -p @superfluid-finance/metadata@1.2.3 bun metadata.mjs ... bunx -p js-sha3@0.9.3 bun selectors.mjs ... ``` Replace example versions with versions that have been reviewed and approved. 2. **Prefer a committed dependency manifest and lockfile.** Add a `package.json` and `bun.lock` or another supported immutable lockfile, and execute scripts using dependencies installed from that lockfile rather than resolving packages dynamically for every invocation. 3. **Use frozen-lockfile installation.** ```bash bun install --frozen-lockfile ``` Configure automation to fail if dependency resolution would modify the lockfile. 4. **Verify package integrity and provenance.** Record expected package integrity hashes, verify registry provenance where available, and review package ownership and release history before upgrades. 5. **Review transitive dependencies.** Automated dependency scanning should cover the complete resolved dependency tree rather than only the directly imported packages. 6. **Control upgrades.** Process dependency updates through reviewed pull requests with lockfile diffs, release-note review, and tests that validate known contract addresses, ABI fingerprints, and selector output. 7. **Reduce execution privileges.** Run these utilities in a sandbox or container without wallet files, private keys, sensitive environment variables, SSH credentials, or unnecessary filesystem write access. 8. **Correct the documentation.** Remove statements implying that runtime package resolution is inherently safe because no explicit installation is required. Clearly disclose that `bunx` downloads and executes third-party code. ]]>