Vulnerable pinned sub-dependencies: @trezor/connect-web alpha pulls a critical protobufjs (GHSA-xq3m-2v4x-88gg)

[actarus314]

Summary

@creit.tech/stellar-wallets-kit resolves to a sub-dependency tree carrying 45 known advisories (1 critical, 21 high) as reported by npm audit. The count is identical on both the current 2.3.0 and the latest 2.4.0 — bumping the kit does not help, because the affected sub-dependencies are pinned to exact versions that are the same in both releases.

Root cause

The kit pins two sub-dependencies to versions whose transitive trees are vulnerable:

1. @trezor/connect-web@10.0.0-alpha.1 (a pre-release alpha) → @trezor/protobuf@10.0.0-alpha.1 → protobufjs ≤ 7.6.2, which is affected by:

   • GHSA-xq3m-2v4x-88gg — Arbitrary code execution in protobufjs (critical)
   • GHSA-66ff-xgx4-vchm, GHSA-75px-5xx7-5xc7, GHSA-jvwf-75h9-cwgg, GHSA-685m-2w69-288q, GHSA-wcpc-wj8m-hjx6 (high), plus several moderate.

   The stable line @trezor/connect-web@9.7.3 is available, and protobufjs is fixed in >= 7.6.3 (latest 8.x).

2. @reown/appkit@1.8.19 → high advisories via viem and ws (e.g. GHSA-96hv-2xvq-fx4p — ws memory-exhaustion DoS, fixed in ws >= 8.20.2). @reown/appkit@1.8.21 is available upstream.

Because these ranges are pinned exactly, downstream consumers cannot remediate via npm overrides without risking breakage of the wallet-connect flow.

Reproduction

npm init -y
npm i @creit.tech/stellar-wallets-kit@2.4.0 --package-lock-only
npm audit
# => 45 vulnerabilities (18 low, 5 moderate, 21 high, 1 critical)
# identical result with @2.3.0

Impact

The critical (protobufjs ACE) and the highs live entirely in the kit's sub-tree. Consumers who prune dev-dependencies keep a clean server runtime, but the affected code is still part of the bundled wallet-connect client surface (Trezor / Reown). Most importantly, the kit itself ships these advisories to every integrator.

Requested fix

• Move @trezor/connect-web off the 10.0.0-alpha.1 pre-release — either to the stable 9.7.x line, or to a v10 release once it depends on protobufjs >= 7.6.3.
• Bump @reown/appkit to >= 1.8.21.
• Consider using caret/semver ranges for these sub-dependencies (instead of exact pins) so patch-level security fixes flow through to integrators automatically.

Environment

• @creit.tech/stellar-wallets-kit: 2.3.0 and 2.4.0 (both reproduce)
• npm 11.16.0, Node 26

[earrietadev]

Hi there!

Thanks for the heads up, will answer one by one:

Move @trezor/connect-web off the 10.0.0-alpha.1 pre-release — either to the stable 9.7.x line, or to a v10 release once it depends on protobufjs >= 7.6.3.

The attack vector for the Trezor dependency is pretty small for the nature of this library because the risk will need that you are interacting with compromised code already and thus even if the kit wasn't available on the build, an attacker can take all they want from the browser without needing the kit

The reason we are using the 10.0.0-alpha.1 version of the Trezor library is because of what we say here: https://github.com/Creit-Tech/Stellar-Wallets-Kit/releases/tag/v2.3.0

Bump @reown/appkit to >= 1.8.21.

This case is also a low vector attack but we can upgrade without issues to this one. I will release a new version today.

Consider using caret/semver ranges for these sub-dependencies (instead of exact pins) so patch-level security fixes flow through to integrators automatically.

The reason we use fixed versions is to avoid hacking vectors coming from compromised dependencies, we know it's not a bullet proof method but it reduces the risk when a new build depending on this kit is deployed.

[jeesunikim]

came here to raise this as well. I will wait for the new release! TY!