T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Unpinned Third-Party SDK Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:27` and `SKILL.md:511` **Vulnerability Type**: Unpinned npm dependency installation **Risk Level**: Medium ### Vulnerable Code At `SKILL.md:27`: ```bash npm install @vultisig/sdk ``` At `SKILL.md:511`: ```bash npm install -g @vultisig/sdk ``` ### Technical Analysis The Skill instructs agents to install `@vultisig/sdk` without specifying an exact, reviewed version or integrity-protected lockfile. Consequently, installation resolves to whichever package version and dependency graph the npm registry serves at execution time. This is particularly sensitive because the package is subsequently trusted to process wallet passwords, mnemonic phrases, vault shares, signing payloads, recipient addresses, and cryptocurrency transactions. A compromised package release, maintainer account, transitive dependency, or registry response could introduce malicious installation or runtime behavior after the Skill itself has been audited. The global installation command increases exposure by placing package executables in a system-wide npm prefix. Depending on the environment and permissions used, those executables may become available to other users or sessions. The audit did not establish that the current package is malicious; the vulnerability is the mutable and insufficiently verified dependency acquisition process. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or a transitive dependency and publishes a malicious release. 2. An agent follows the documented unpinned `npm install` command. 3. npm resolves and installs the attacker-controlled release or dependency. 4. Malicious lifecycle or runtime code executes with the permissions of the installing agent. 5. When the agent creates or imports a vault, the compromised SDK can intercept sensitive wallet inputs, alter recipient addresses or transaction payloads, manipulate signing operations, ...[truncated 1432 chars]
- Remediation
- ## Remediation Suggestions 1. Replace unversioned installation instructions with an exact, reviewed SDK version, for example: ```bash npm install --save-exact @vultisig/sdk@<reviewed-version> ``` 2. Commit a lockfile and use `npm ci` in automated environments so the complete dependency graph is reproducible and integrity hashes are enforced. 3. Remove the global installation recommendation. Prefer project-local binaries invoked through package scripts or `npx --no-install`. 4. Verify package provenance, publisher identity, signatures or attestations where available, and npm integrity metadata before deployment. 5. Audit both the direct SDK package and its resolved transitive dependencies before allowing access to mnemonic phrases, vault shares, passwords, or funded wallets. 6. Install and run the SDK under a dedicated, unprivileged account or sandbox with restricted filesystem and network access. Do not use administrator or root privileges for package installation. 7. Apply outbound-network allowlisting so the SDK can communicate only with documented Vultisig, blockchain RPC, indexer, and swap-provider endpoints. 8. Use test wallets and low-value transaction limits until each dependency update has been independently reviewed. Require human approval for high-value transfers. 9. Document the SDK's sensitive-data flow, including whether mnemonic phrases are processed exclusively on-device and exactly which vault material is sent to VultiServer.