T08 · Insecure Dependencies
Warning
- Location
- README.md:7
- Finding
- Unpinned Third-Party Package Execution During Installation## Vulnerability Details **File Location**: `README.md`, line 7 **Vulnerability Type**: Supply-chain risk caused by unpinned package execution **Risk Level**: Medium **Vulnerable Code**: ```bash npx clawhub install abishekdharshan/zerion-api ``` ### Technical Analysis The documented installation command invokes `clawhub` through `npx` without pinning the package to a reviewed version or integrity digest. If the package is not already available locally, `npx` may retrieve it from the configured npm registry and execute it with the installing user's privileges. Because package resolution can change after this project has been audited, the effective installer code is not fully represented by the two reviewed files. A compromised publisher account, registry compromise, or malicious future package release could cause the same documented command to execute attacker-controlled code. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or the package-distribution path used to resolve `clawhub`. 2. The attacker publishes a malicious release that is selected by the unpinned package reference. 3. A user follows the installation instructions and runs the documented `npx` command. 4. `npx` downloads and executes the malicious package code. 5. The payload runs with the user's current OS privileges and can access resources available to that account. ### Impact Assessment Successful exploitation could allow arbitrary code execution with the installing user's privileges. Depending on the local environment and user permissions, this could expose readable files, development credentials, API keys, and environment variables; modify user-owned files or configuration; or install additional malicious components. The command itself does not request elevated privileges, so its direct scope is normally limited to the invoking user's access unless it is run from an elevated shell.
- Remediation
- ## Remediation Suggestions - Pin the installer CLI to a specifically reviewed version rather than relying on the registry's current resolution. - Use a lockfile or another integrity-verification mechanism where supported. - Document the expected package publisher, registry, version, and cryptographic integrity value. - Prefer a previously installed and independently verified CLI instead of downloading executable package code at installation time. - Review each proposed dependency update before changing the pinned version. - Advise users not to run the installation command with administrator or root privileges.