T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:28
- Finding
- Security-Critical npm Dependencies Are Installed Without Version Pinning## Vulnerability Details **File Location**: `SKILL.md`, lines 28, 143, 187, and 277 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:28` ```bash npm install @arkade-os/sdk ``` `SKILL.md:143` ```bash npm install @arkade-os/boltz-swap ``` `SKILL.md:187` ```bash npm install @arkade-os/skill ``` `SKILL.md:277` ```bash npm install @arkade-os/sdk @scure/base ``` ### Technical Analysis The installation instructions do not pin the npm dependencies to exact, reviewed versions. No lockfile, package integrity hashes, trusted registry configuration, or package-verification procedure is included in the audited project. Consequently, the code installed by these commands may differ from the code that was originally reviewed or expected when the Skill was authored. This is security-sensitive because the referenced libraries operate on Bitcoin wallet identities, transaction signing, Lightning swaps, and stablecoin swaps. The examples pass an identity derived from private key material into the SDK: ```typescript const identity = SingleKey.fromHex("your-private-key-hex"); ``` A compromised or unexpectedly changed dependency could therefore execute during installation through npm lifecycle scripts or at runtime with access to wallet objects and signing operations. The audit did not establish that any referenced package is currently malicious; the vulnerability is the mutable and unverifiable dependency trust boundary. ### Attack Path 1. An attacker compromises a maintainer account, npm package release process, or another component in the dependency chain. 2. The attacker publishes a malicious or backdoored release under one of the referenced package names. 3. A user follows the documented unpinned `npm install` command. 4. npm resolves the mutable package version and downloads the compromised release. 5. Malicious code executes through an installa ...[truncated 1181 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every dependency to an exact, reviewed version rather than allowing npm to select a mutable release. 2. Provide and commit a lockfile containing npm integrity hashes, and direct users and CI systems to use `npm ci`. 3. Review the complete transitive dependency graph and repeat the review before upgrading any package. 4. Configure npm to use an explicitly trusted registry and consider organization-level package allowlists. 5. Disable installation lifecycle scripts where compatible, such as with `npm ci --ignore-scripts`, or explicitly review every required lifecycle script. 6. Use automated dependency monitoring, provenance verification, and package-signature or attestation checks where available. 7. Run wallet applications in a least-privilege, isolated environment with restricted filesystem and network access. 8. Keep raw private keys outside general application memory where possible. Use a hardware wallet, external signer, or dedicated secrets-management system with transaction-policy enforcement. 9. Independently verify destination addresses, networks, amounts, and fee parameters before authorizing financial transactions. 10. Include the implementation and dependency metadata for `@arkade-os/skill` in the review scope before recommending it for production use.