T08 · Insecure Dependencies
Warning
- Location
README.md:15- Finding
Unpinned Package Execution Through npx
- Content
View full analysis
Vulnerability Details
File Location:
README.md, lines 15-18
Vulnerability Type:T08: Insecure Dependencies
Risk Level: MediumVulnerable Code Snippet:
markdown Via ClawHub: ```bash npx clawhub install abishekdharshan/zerion-apitext ### Technical Analysis The documented installation command invokes `clawhub` through `npx` without specifying a package version or integrity constraint. If the package is unavailable locally, `npx` may retrieve and execute the currently resolved release from the npm registry. Because neither a reviewed version nor a cryptographic integrity digest is specified, the code executed by this command can change after this project has been audited. This creates a supply-chain trust boundary outside the reviewed repository. The audit found no evidence that the current `clawhub` package is malicious; the vulnerability is the unsafe, unpinned execution pattern. ### Attack Path 1. An attacker compromises the npm account, publication pipeline, package registry path, or another component controlling the package resolved as `clawhub`. 2. The attacker publishes a malicious or backdoored release under the package name. 3. A user follows the installation command from `README.md`. 4. `npx` resolves and downloads the attacker-controlled release because no version or integrity digest is pinned. 5. The downloaded package executes with the privileges of the user running the command. 6. The malicious package can access or modify resources available to that user before or during installation. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on the user's environment, this may expose local files, environment variables, API credentials, source repositories, wallet-related configuration, and other user-accessible data. It may also allow modification of user-owned files or development tooling. Admini ...[truncated 126 chars]- Remediation
View remediation
Remediation Suggestions
- Pin
clawhubto a specifically reviewed version, for example:bash npx clawhub@<reviewed-version> install abishekdharshan/zerion-api - Prefer a package-manager workflow that verifies a lockfile and registry-provided integrity hash.
- Document the expected package publisher and official source repository so users can verify provenance.
- Consider installing the reviewed CLI version separately and then invoking it without allowing implicit retrieval of the latest release.
- In CI or other sensitive environments, use an approved internal registry mirror or allowlist and run installation with least privilege.
- Periodically review and deliberately update the pinned version rather than automatically executing new releases.
- Pin