T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:10
- Finding
- Unpinned npm Dependency Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 10-13 **Vulnerability Type**: Unpinned third-party package dependency **Risk Level**: Medium ```yaml install: - kind: node package: nansen-cli bins: [nansen] ``` ### Technical Analysis The Skill installs `nansen-cli` without specifying an exact version or package integrity digest. Consequently, installation can resolve to a future package release that was not included in this audit. This makes the effective code executed by the Skill dependent on mutable npm registry state. If the package publisher account, registry distribution path, or a future release is compromised, malicious package installation scripts or runtime logic could execute under the privileges of the user installing or invoking the Skill. The required `NANSEN_API_KEY` may also be exposed to malicious runtime code when it is present in the process environment. No evidence was found that the currently referenced package is malicious. The vulnerability is the lack of dependency pinning and integrity enforcement, which prevents the reviewed Skill from guaranteeing that future installations use the reviewed dependency version. ### Attack Path 1. An attacker compromises the `nansen-cli` publication account or causes a malicious future release to be published through the package distribution channel. 2. A user installs the Skill after that release becomes the version selected by the package manager. 3. Because no exact version or integrity digest is declared, the installer retrieves the attacker-controlled release. 4. Malicious lifecycle code may execute during installation, or malicious CLI code may execute when one of the documented `nansen research` commands is invoked. 5. The malicious code operates with the installing or invoking user's privileges and may access process environment variables, including `NANSEN_API_KEY`, as well as other files and network resources available to that u ...[truncated 515 chars]
- Remediation
- ## Remediation Suggestions - Pin `nansen-cli` to a reviewed exact version rather than allowing the package manager to select the latest compatible release. - Use a lockfile or package-manager integrity metadata to verify the expected package archive cryptographically. - Retrieve the dependency only from an explicitly trusted registry and enforce registry configuration in the installation process where supported. - Review the selected package version, including lifecycle scripts and transitive dependencies, before deployment. - Disable npm lifecycle scripts during installation if the package does not require them. - Run installation and execution as an unprivileged user with access only to necessary files and environment variables. - Provide `NANSEN_API_KEY` only at runtime, avoid exposing unrelated credentials to the process, and rotate the key if dependency compromise is suspected. - Add automated dependency monitoring so that upgrades require explicit security review rather than silently changing installed code.