T08 · Insecure Dependencies
- Location
README.md:26- Finding
Unpinned npm Package Execution Through npx
- Content
View full analysis
Vulnerability Details
File Location:
README.md, lines 26-28
Vulnerability Type: Supply-chain exposure caused by executing a mutable dependency version
Risk Level: MediumComplete Code Snippet:
bash npx clawhub@latest install akang943578/my-skills/network-hot-topicsTechnical Analysis
The documented installation command instructs users to execute the
clawhubnpm package throughnpxusing the mutablelatestdistribution tag. The command does not pin a reviewed package version or verify a package integrity hash, signature, or publisher identity.Because npm distribution tags can be reassigned, the code executed by this command can change after the Skill has been audited. If the package, publisher account, npm registry path, or release process is compromised, users following the documentation could download and execute attacker-controlled code.
This is an insecure dependency execution pattern. The repository itself does not contain an embedded malicious payload, and exploitation depends on compromise or malicious replacement of the externally retrieved npm package.
Attack Path
- An attacker compromises the
clawhubnpm publisher account, release pipeline, package, or relevant registry infrastructure. - The attacker publishes a malicious package release and assigns the mutable
latesttag to that release. - A user follows the installation command in
README.md. npxresolvesclawhub@latest, downloads the attacker-controlled package, and invokes its executable.- Malicious package lifecycle or executable code runs with the permissions of the user who invoked the command.
Impact Assessment
Successful exploitation could provide arbitrary code execution under the installing user's account. The attacker could access files, credentials, environment variables, network resources, and other assets available to that user. If the command is executed from an elevated shell ...[truncated 359 chars]
- An attacker compromises the
- Remediation
View remediation
Remediation Suggestions
- Replace the mutable
latesttag with an exact, reviewed package version, for exampleclawhub@X.Y.Z. - Verify the selected release and publisher before recommending the command.
- Where supported, document and enforce package integrity verification using a trusted lockfile, cryptographic digest, package signature, or provenance attestation.
- Prefer an installation workflow that downloads dependencies without immediately executing them, allowing inspection and verification before use.
- Advise users to run the installer with least privilege and not from an administrator or root shell.
- Establish a controlled update process in which new installer versions are reviewed before the pinned version in the documentation is changed.
- Replace the mutable