T08 · Insecure Dependencies
Warning
- Location
- README.md:16
- Finding
- Unpinned Global npm Package Installation with Package-Identity Mismatch## Vulnerability Details **File Location**: `README.md`, line 16 **Vulnerability Type**: Supply-chain exposure through an unpinned global dependency **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g clawdhub && clawdhub install para-wallet ``` ### Technical Analysis The installation instructions execute the latest available version of the third-party `clawdhub` npm package without an exact version, lockfile, or integrity verification. Because npm packages may execute lifecycle scripts during installation, installing an untrusted or compromised release can immediately execute code with the privileges of the user running npm. There is also a package-identity inconsistency: the project describes and links “ClawhHub” and `clawhhub.com`, while the installed npm package and executable are named `clawdhub`. This mismatch increases the risk that users may install a typographically similar, unintended, or spoofed package. The `-g` flag expands the consequences by installing the package globally and exposing its executable through the user's global command path. ### Attack Path 1. An attacker publishes or compromises a release under the referenced `clawdhub` npm package name. 2. The malicious release includes an npm lifecycle script or a modified command-line executable. 3. A user follows the documented command without verifying the package identity, version, provenance, or integrity. 4. npm resolves the mutable package version and installs it globally. 5. Any lifecycle script executes during installation with the invoking user's privileges. 6. The chained `clawdhub install para-wallet` command then executes the installed binary, providing a second opportunity for arbitrary malicious behavior. ### Impact Assessment Successful exploitation can provide arbitrary code execution under the account running the installation command. The attacker may access files and environment variables available to that account, including potentially configured API credent ...[truncated 399 chars]
- Remediation
- ## Remediation Suggestions 1. Confirm the canonical package identity and correct the discrepancy between “ClawhHub” and `clawdhub`. 2. Pin the dependency to a reviewed exact version, for example `clawdhub@X.Y.Z`, rather than resolving the latest mutable release. 3. Publish the canonical npm registry page and source repository so users can verify package ownership and provenance. 4. Provide integrity or signature verification instructions where supported. 5. Avoid global installation where possible. Prefer a locally pinned development dependency or an isolated package runner with an explicit version. 6. Audit npm lifecycle scripts and package contents before recommending the package. 7. Prefer the documented direct-copy installation method for this Markdown-only skill when the package manager is not required. 8. Advise users not to run the installation command with `sudo` or another elevated account.