๐จ Always verify your dependencies!
During a recent audit, I discovered that a team accidentally used an unofficial npm package instead of the official Wormhole SDK. This highlights a critical dependency verification issue we all need to watch for.
What happened:
- Team used wormhole-solidity-sdk npm package
npmjs.com/package/wormhole-sโฆ
- The official Wormhole SDK is only available via forge from their GitHub repo
github.com/wormhole-foundatiโฆ
- The team was genuinely surprised - they thought it was official!
Takeaways:
โ
Always verify package authenticity before using
โ
Check official documentation for approved distribution methods
โ
Be suspicious of packages with low download counts
โ
Look for official namespace patterns (like
@wormhole-foundation)
While the unofficial package seemed mostly aligned with the official version for relevant parts, we can't guarantee what's in other files.
Stay vigilant, fellow auditors! ๐