T08 · Insecure Dependencies
- Location
SKILL.md:179- Finding
Unpinned Remote npm Package Execution for a Mainnet Wallet
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 179-185
Vulnerability Type: Supply-chain risk caused by executing an unpinned remote npm package
Risk Level: Highbash ## Upgrading ```bash # Stop the running daemon npx @moneydevkit/agent-wallet stop # Run with @latest to pull the newest version npx @moneydevkit/agent-wallet@latest starttext The same unsafe pattern also appears in operational examples throughout `SKILL.md`, including lines 55-65, 79, and 106-173, where `npx @moneydevkit/agent-wallet` is invoked without an exact version. ### Technical Analysis The skill directs the agent to use `npx` to retrieve and immediately execute `@moneydevkit/agent-wallet`. The upgrade procedure explicitly selects the mutable `@latest` tag, while most other examples omit a version and therefore also resolve through mutable package metadata. This project's only audited file is `SKILL.md`; it does not contain the dependency's executable implementation. Consequently, the code that handles the BIP39 mnemonic, wallet transactions, local daemon, filesystem state, and outbound connections is outside the reviewed artifact and can change after this audit. Although line 48 recommends pinning version `0.11.0` in production, that recommendation is not applied consistently to the documented commands. Package repository links also do not cryptographically bind the downloaded npm artifact to reviewed source code. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or a transitive dependency used by `@moneydevkit/agent-wallet`. 2. The attacker publishes a malicious release and causes it to resolve through the unpinned package name or the `@latest` tag. 3. An agent follows the documented `npx` command. 4. `npx` downloads and executes the modified package under the agent user's account. 5. The malicious package reads `~/.mdk-wallet/config.json`, captures the BIP39 mn ...[truncated 1061 chars]- Remediation
View remediation
Remediation Suggestions
-
Replace every invocation with a reviewed, exact package version, for example:
bash npx --yes @moneydevkit/agent-wallet@0.11.0 startApply the exact version consistently to initialization, balance, receive, send, daemon-management, and upgrade commands.
-
Remove
@latestfrom operational documentation. Treat upgrades as a separate, explicitly approved process that includes source review, release verification, and testing before the new version can access a funded wallet. -
Prefer a lockfile-backed installation over ad hoc
npxretrieval. Pin all transitive dependencies and preserve npm integrity hashes. For stronger assurance, vendor or build the dependency from a reviewed commit and verify the produced artifact. -
Verify package provenance, publisher identity, signatures or attestations where available, and correspondence between the npm tarball and the cited source repository.
-
Run the wallet under a dedicated, unprivileged operating-system account or sandbox. Restrict filesystem access to the required wallet directory and allow outbound network access only to necessary endpoints.
-
Enforce owner-only permissions on
~/.mdk-wallet/and its mnemonic-bearing configuration. Keep mnemonic backups outside the runtime environment and avoid exposing the seed in logs or command output. -
Test upgrades with an unfunded wallet before approving them for mainnet use. Require explicit human authorization for high-value or unusual outbound payments.
-