T08 · Insecure Dependencies
Error
- Location
- SKILL.md:14
- Finding
- Unpinned npm Package Is Downloaded and Executed Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 14-25 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```bash # Estimate cost for spotlight placement npx @signet-base/cli estimate --hours 6 # List recent signatures npx @signet-base/cli list --count 10 # Post a URL (simulate first to check cost) npx @signet-base/cli post --url https://example.com --hours 6 --simulate # Post for real (requires PRIVATE_KEY env or --private-key) PRIVATE_KEY=0x... npx @signet-base/cli post --url https://example.com --hours 6 ``` ### Technical Analysis The documented commands invoke `@signet-base/cli` through `npx` without specifying an exact package version. If the package is not already available locally, `npx` can retrieve and immediately execute the version currently resolved by the npm registry. There is no lockfile, integrity hash, trusted package snapshot, or publisher verification in the audited project. Consequently, the code executed at runtime can differ from the code that was previously reviewed. This is particularly sensitive because the package is invoked in a process that may have access to a blockchain private key. This finding concerns the unsafe dependency execution mechanism; the available evidence does not establish that the current package itself is malicious. ### Attack Path 1. An attacker compromises the package publisher, npm account, registry resolution path, or a future package release. 2. The attacker publishes a modified version of `@signet-base/cli`. 3. A user or agent follows the Skill and runs an unversioned `npx @signet-base/cli` command. 4. `npx` resolves, downloads, and executes the attacker-controlled release. 5. The malicious package reads accessible environment variables, including `PRIVATE_KEY`, modifies transaction or payment parameters, or performs arbitrary actions with the invoking process's operating-system privi ...[truncated 398 chars]
- Remediation
- ## Remediation Suggestions - Pin `@signet-base/cli` to a reviewed, exact version rather than resolving the latest release. - Install it through a package manifest and committed lockfile using integrity-verifying installation procedures. - Verify package ownership, provenance, signatures, and registry integrity before execution. - Avoid granting the CLI direct access to a valuable wallet key. Use a dedicated, low-value wallet with narrowly limited funds. - Run the package in a sandbox with restricted filesystem, environment, and network access. - Establish an update-review process so package version changes are inspected before deployment.