T08 · Insecure Dependencies
Warning
- Location
- scripts/package.json:5
- Finding
- Unpinned Dependencies and Mutable Repository Checkout<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/package.json:5-6` - `SKILL.md:119` - `SKILL.md:145-147` - `SKILL.md:180-182` - `SKILL.md:338` - `erc-8004-base.md:16` **Vulnerability Type**: Supply-chain exposure through mutable dependency sources **Risk Level**: Medium ### Vulnerable Code `scripts/package.json:5-6`: ```json "@farcaster/core": "^0.15.0", "viem": "^2.47.0" ``` `SKILL.md:145-147`: ```bash git clone https://github.com/clawd800/agentcast-ai.git cd agentcast-ai npm install viem ``` `SKILL.md:180-182`: ```bash git clone https://github.com/clawd800/agentcast-ai.git cd agentcast-ai npm install viem ``` `SKILL.md:119` and `SKILL.md:338`: ```bash cd agentcast-ai/agentcast/scripts && npm install ``` `erc-8004-base.md:16`: ```bash npm install viem ``` ### Technical Analysis The documented installation process clones the mutable default branch of a remote Git repository and installs packages from the npm registry. The dependencies in `scripts/package.json` use caret version ranges, and the audited project does not include a lockfile that fixes the complete dependency graph and integrity hashes. Consequently, the code installed by a user may differ from the code reviewed during this audit. A future version matching the caret ranges, a changed transitive dependency, or a modified default branch could introduce malicious code. npm packages can also define lifecycle scripts that run during installation. This is particularly sensitive because the scripts are subsequently invoked with wallet private keys and Farcaster signer keys in environment variables. Although the audited scripts do not transmit raw keys, newly resolved or compromised dependency code executes in the same Node.js process and can access `process.env`. ### Attack Path 1. An attacker compromises the upstream Git repository, an allowed npm package version, or a transitive dependency. 2. The attacker publishes code within the permitted version range or modifies the ...[truncated 1274 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace caret dependency ranges with reviewed exact versions: ```json { "dependencies": { "@farcaster/core": "0.15.0", "viem": "2.47.0" } } ``` 2. Generate, review, and commit `package-lock.json` so the entire transitive dependency graph and package integrity hashes are fixed. 3. Replace `npm install` in operational documentation with: ```bash npm ci ``` 4. Pin repository checkout instructions to a reviewed commit hash or signed release tag rather than the mutable default branch: ```bash git clone https://github.com/clawd800/agentcast-ai.git cd agentcast-ai git checkout --detach <reviewed-commit-hash> npm ci ``` 5. Review dependency lifecycle scripts. Where dependencies do not require them, install using: ```bash npm ci --ignore-scripts ``` 6. Run dependency installation in an environment that does not contain wallet keys, signer keys, API keys, or other sensitive environment variables. 7. Execute wallet-related scripts in an isolated, least-privileged environment and expose only the credentials required for the specific operation. 8. Add automated dependency integrity, vulnerability, and provenance checks to the release process. Review all lockfile changes before merging or publishing a new release. ]]>