T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:43
- Finding
- Unpinned Third-Party Packages Execute with Access to Wallet Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43, 84–135, 162–192, and 377–383 **Vulnerability Type**: Unpinned and mutable JavaScript dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm install @ethcf/agenticmoney ethers ``` The Skill repeatedly invokes `tsx` through `npx`, including: ```bash npx tsx -e " import { createAgentSDK, NETWORKS } from '@ethcf/agenticmoney'; import { ethers } from 'ethers'; const provider = new ethers.JsonRpcProvider('https://ethereum-sepolia.publicnode.com'); const wallet = new ethers.Wallet(process.env.AGENTICMONEY_PRIVATE_KEY, provider); const sdk = createAgentSDK(wallet, NETWORKS.sepolia); ``` The troubleshooting section also recommends installing an unpinned global package: ```bash npm install -g tsx # Or use: npx tsx -e "..." ``` ### Technical Analysis The Skill installs `@ethcf/agenticmoney`, `ethers`, and `tsx` without exact version constraints or integrity verification. It also uses `npx tsx`, which can retrieve and execute a currently published package when a trusted local copy is unavailable. These packages execute in a process that reads `AGENTICMONEY_PRIVATE_KEY`. Therefore, dependency code has access to the wallet credential and can influence transaction construction, recipients, values, RPC interactions, and signing behavior. Because package versions are not pinned and no lockfile, integrity hash, or provenance check is specified, the effective code executed by the instructions can change after the Skill has been reviewed. A compromised maintainer account, malicious package update, registry compromise, or dependency-resolution attack could introduce hostile code without modifying `SKILL.md`. ### Attack Path 1. An attacker compromises a package maintainer, package release, transitive dependency, or relevant registry resolution path. 2. The attacker publishes a malicious version of `tsx`, `ethers`, `@ethcf/agenticmoney`, or one of their dependencies. 3. A user follows ...[truncated 999 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to an exact, audited version rather than accepting the latest compatible release. 2. Provide and enforce a committed lockfile with verified integrity metadata. 3. Use `npm ci` instead of unconstrained `npm install` for reproducible installation. 4. Install `tsx` as a pinned local development dependency and invoke the local binary rather than using an unpinned global installation or dynamic `npx` download. 5. Consider `npm ci --ignore-scripts` where package functionality permits it, and audit any package that requires lifecycle scripts. 6. Verify package provenance, publisher identity, signatures, and registry source before installation. 7. Run blockchain tooling in an isolated environment with minimal network and filesystem access. 8. Avoid exposing a high-value private key directly to general-purpose dependency code. Prefer a restricted signer, hardware wallet, delegated low-balance wallet, or external signing process. 9. Re-audit dependencies and their transitive dependency trees before updating pinned versions. ]]>