T08 · Insecure Dependencies
- Location
install.sh:5- Finding
Unpinned Remote Source Is Retrieved, Compiled, and Installed
- Content
View full analysis
Vulnerability Details
File Location:
install.sh:5-20
Vulnerability Type: Unverified and mutable software supply chain
Risk Level: Mediumbash REPO_URL="${STEGSTR_REPO_URL:-https://github.com/brunkstr/Stegstr.git}" INSTALL_DIR="${STEGSTR_INSTALL_DIR:-$HOME/.local/stegstr}" BIN_DIR="${STEGSTR_BIN_DIR:-$HOME/.local/bin}" echo "Cloning Stegstr..." mkdir -p "$(dirname "$INSTALL_DIR")" if [ -d "$INSTALL_DIR" ]; then (cd "$INSTALL_DIR" && git pull) else git clone "$REPO_URL" "$INSTALL_DIR" fi echo "Building stegstr-cli..." (cd "$INSTALL_DIR/src-tauri" && cargo build --release --bin stegstr-cli) mkdir -p "$BIN_DIR" ln -sf "$INSTALL_DIR/src-tauri/target/release/stegstr-cli" "$BIN_DIR/stegstr-cli"The same unpinned build process is also recommended in
SKILL.md:39-43andREADME.md:10-13.Technical Analysis
The installer retrieves the current state of a remote Git repository without checking out a fixed, reviewed commit or verifying a cryptographic checksum or signature. For an existing installation,
git pullincorporates new upstream changes automatically. The resulting source is immediately passed to Cargo and the compiled executable is linked into the user's local binary directory.Cargo compilation can execute package build scripts in addition to producing the requested binary. Consequently, compromise of the upstream repository or one of its build-time dependencies could result in code execution during installation, before the final CLI is invoked.
The configurable
STEGSTR_REPO_URLalso permits the installer to retrieve and compile an alternative repository. This option is not intrinsically malicious, but if an attacker can influence the installation environment, it provides a direct way to substitute attacker-controlled source.Attack Path
- An attacker compromises or modifies the mutable upstream branch, a resolved Cargo dependency, or an envir ...[truncated 1477 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin installation to a specific, reviewed commit hash or cryptographically signed release tag rather than the repository's current default branch.
- Replace
git pullwith a deterministic detached checkout of the approved revision. Prefer a clean checkout so local or upstream branch state cannot silently alter the build. - Verify the upstream commit signature or verify a published release artifact against an independently distributed SHA-256 checksum or signature before execution.
- Commit and review
Cargo.lock, then build withcargo build --release --locked --bin stegstr-clito prevent unreviewed dependency resolution changes. - Audit Cargo dependencies and build scripts, and use dependency-vulnerability and supply-chain review tooling as part of release preparation.
- Do not allow arbitrary repository substitution by default. If
STEGSTR_REPO_URLmust remain configurable, require an explicit opt-in and validate the selected source and revision against an approved allowlist. - Update
SKILL.mdandREADME.mdso their installation commands use the same pinned revision and integrity-verification procedure. - Build in an isolated, least-privileged environment with restricted access to credentials and sensitive files.