T08 · Insecure Dependencies
Error
- Location
- scripts/setup.js:30
- Finding
- Automatic Installation and Execution of an Unpinned Third-Party Payment Package<![CDATA[ ## Vulnerability Details **File Location**: `package.json:22-24`, `scripts/setup.js:13-23, 30-33`, `scripts/setup.sh:10-14` **Vulnerability Type**: Unpinned third-party dependency automatically downloaded and executed during installation **Risk Level**: High ### Vulnerable Code `package.json:22-24` automatically invokes the setup program during package installation: ```json "scripts": { "setup": "node scripts/setup.js", "postinstall": "node scripts/setup.js" }, ``` `scripts/setup.js:13-23` executes shell commands and suppresses failures: ```javascript function run(cmd, silent = false) { try { return execSync(cmd, { encoding: 'utf8', stdio: silent ? 'pipe' : 'inherit' }); } catch (e) { return null; } } ``` `scripts/setup.js:30-33` downloads the unconstrained current release globally and then executes the resulting command: ```javascript if (!commandExists('moltspay')) { console.log('📦 Installing moltspay...'); run('npm install -g moltspay'); console.log('✅ moltspay installed\n'); } else { ``` The downloaded program is subsequently invoked at `scripts/setup.js:39-40`: ```javascript console.log('🔐 Initializing wallet...'); run('moltspay init --chain base --max-per-tx 2 --max-per-day 10'); ``` The alternative shell setup path contains the same unsafe installation behavior at `scripts/setup.sh:10-14`: ```bash if ! command -v moltspay &> /dev/null; then echo "📦 Installing moltspay..." npm install -g moltspay echo "✅ moltspay installed" else ``` ### Technical Analysis The project does not declare an exact, reviewed version of `moltspay`, provide a lockfile or integrity constraint for it, or bundle a reviewed implementation. Instead, its `postinstall` lifecycle hook invokes `scripts/setup.js`, which runs `npm install -g moltspay`. This resolves and downloads whichever release is current in the configured npm registry at installation time. Consequently, the code audited in this project doe ...[truncated 2852 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the automatic global installation from `postinstall`. Package installation should not implicitly download and execute a financial wallet tool. 2. Require explicit, informed user confirmation before installing the CLI or initializing a wallet. 3. Declare `moltspay` as a local dependency using an exact audited version rather than invoking `npm install -g`: ```json { "dependencies": { "moltspay": "X.Y.Z" } } ``` 4. Commit and enforce a package lockfile, and verify registry integrity metadata in deployment or installation workflows. 5. Invoke the pinned local executable through an npm script or a direct path under `node_modules/.bin`; do not rely on ambient `PATH` resolution. 6. Separate dependency installation from wallet initialization. Wallet creation should occur only after dependency provenance has been validated and the user has explicitly requested it. 7. Fail closed when installation or initialization fails. Check command exit status and stop execution rather than returning `null` and printing a success message. 8. Verify the resolved executable path and expected version before allowing wallet or payment operations. 9. Replace documentation that recommends unconstrained `npx moltspay` execution with commands that use the pinned local dependency. 10. Review the pinned dependency and its transitive dependencies specifically for private-key handling, transaction construction, endpoint trust, and secret transmission before enabling real-money operations. ]]>