T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:158
- Finding
- Unpinned npm Dependencies May Execute Mutable Third-Party Code## Vulnerability Details **File Location**: `SKILL.md`, lines 158–164 **Vulnerability Type**: Unpinned third-party dependencies and unsafe package execution **Risk Level**: Medium ### Vulnerable Code ```markdown **Hardhat Plugin:** `npm install --save-dev @qelt/hardhat-verify@latest` ```bash npx hardhat qelt:verify --network qelt 0xCONTRACT_ADDRESS ``` **CLI Tool:** `npm install -g qelt-verify` → `qelt-verify verify 0x... ./Contract.sol --compiler-version 0.8.20 --optimize` ``` The same unsafe installation pattern is repeated in `references/verification-guide.md`, lines 158–170: ```markdown Latest version: `@qelt/hardhat-verify@1.0.12` ```bash npm install --save-dev @qelt/hardhat-verify@latest npx hardhat qelt:verify --network qelt 0xCONTRACT_ADDRESS ``` Features: auto-detects viaIR, EVM version, routes single vs multi-file automatically. ## CLI Tool Latest version: `qelt-verify@1.1.0` ```bash npm install -g qelt-verify qelt-verify init qelt-verify verify 0xCONTRACT ./Contract.sol --compiler-version 0.8.20 --optimize --watch ``` ``` ### Technical Analysis The documented workflow installs `@qelt/hardhat-verify` through the mutable `latest` tag and installs `qelt-verify` without specifying a version. It then executes the installed tools. Consequently, the code reviewed today is not necessarily the code users will install later. npm packages can execute lifecycle scripts during installation. The packages also obtain direct code execution when users invoke the Hardhat task or CLI. If a package, maintainer account, release process, or transitive dependency is compromised, a malicious future release could execute arbitrary code with the permissions of the user running npm. Global installation of `qelt-verify` increases system-wide exposure and makes dependency provenance harder to reproduce. The guide identifies current package versions, but the installation commands do not pin those versions and provide no integrity or provenance verification. ### At ...[truncated 1549 chars]
- Remediation
- ## Remediation Suggestions 1. Replace mutable or implicit versions with reviewed exact versions: ```bash npm install --save-dev --save-exact @qelt/hardhat-verify@1.0.12 npm install --save-dev --save-exact qelt-verify@1.1.0 ``` 2. Avoid global package installation. Prefer a pinned local development dependency invoked through a package script or an explicitly pinned command. 3. Commit a lockfile and use reproducible installation in automated environments: ```bash npm ci ``` 4. Review package provenance, publisher identity, lifecycle scripts, and transitive dependencies before recommending or upgrading a version. 5. Validate package integrity through the lockfile and npm registry integrity metadata. Where supported, require package provenance attestations. 6. Introduce a controlled dependency-update process in which new releases are reviewed and tested before the documentation's pinned version is changed. 7. Retain the direct HTTPS REST API workflow as the preferred option when installation of third-party executable tooling is unnecessary. 8. Update both `SKILL.md` and `references/verification-guide.md` together so that their commands consistently use the same reviewed versions.