T08 · Insecure Dependencies
- Location
SKILL.md:28- Finding
Security-Critical npm Dependencies Are Installed Without Version Pinning
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 28, 143, 187, and 277
Vulnerability Type: T08: Insecure Dependencies
Risk Level: MediumVulnerable Code
SKILL.md:28bash npm install @arkade-os/sdkSKILL.md:143bash npm install @arkade-os/boltz-swapSKILL.md:187bash npm install @arkade-os/skillSKILL.md:277bash npm install @arkade-os/sdk @scure/baseTechnical Analysis
The installation instructions do not pin the npm dependencies to exact, reviewed versions. No lockfile, package integrity hashes, trusted registry configuration, or package-verification procedure is included in the audited project. Consequently, the code installed by these commands may differ from the code that was originally reviewed or expected when the Skill was authored.
This is security-sensitive because the referenced libraries operate on Bitcoin wallet identities, transaction signing, Lightning swaps, and stablecoin swaps. The examples pass an identity derived from private key material into the SDK:
typescript const identity = SingleKey.fromHex("your-private-key-hex");A compromised or unexpectedly changed dependency could therefore execute during installation through npm lifecycle scripts or at runtime with access to wallet objects and signing operations. The audit did not establish that any referenced package is currently malicious; the vulnerability is the mutable and unverifiable dependency trust boundary.
Attack Path
- An attacker compromises a maintainer account, npm package release process, or another component in the dependency chain.
- The attacker publishes a malicious or backdoored release under one of the referenced package names.
- A user follows the documented unpinned
npm installcommand. - npm resolves the mutable package version and downloads the compromised release.
- Malicious code executes through an installa ...[truncated 1181 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin every dependency to an exact, reviewed version rather than allowing npm to select a mutable release.
- Provide and commit a lockfile containing npm integrity hashes, and direct users and CI systems to use
npm ci. - Review the complete transitive dependency graph and repeat the review before upgrading any package.
- Configure npm to use an explicitly trusted registry and consider organization-level package allowlists.
- Disable installation lifecycle scripts where compatible, such as with
npm ci --ignore-scripts, or explicitly review every required lifecycle script. - Use automated dependency monitoring, provenance verification, and package-signature or attestation checks where available.
- Run wallet applications in a least-privilege, isolated environment with restricted filesystem and network access.
- Keep raw private keys outside general application memory where possible. Use a hardware wallet, external signer, or dedicated secrets-management system with transaction-policy enforcement.
- Independently verify destination addresses, networks, amounts, and fee parameters before authorizing financial transactions.
- Include the implementation and dependency metadata for
@arkade-os/skillin the review scope before recommending it for production use.