T08 · Insecure Dependencies
Error
- Location
install.sh:21- Finding
Unpinned third-party packages are executed during installation
- Content
View full analysis
/dev/null || true ``` The documentation also instructs users to execute a mutable npm package version: ```bash npx clawhub@latest install agentic-ai-gold ``` ### Technical Analysis The installer downloads and executes six Python packages without exact version constraints, a lockfile, or package hashes. The documented `npx clawhub@latest` command similarly executes whichever release is tagged as `latest` at execution time. Python and npm package installations can execute package-controlled installation or build logic. Consequently, the effective code executed during installation can change after this project has been audited. The command also redirects dependency errors to `/dev/null` and uses `|| true`. This suppresses both installation errors and dependency-resolution failures, leaving the environment in an unknown or partially installed state while installation continues. No evidence establishes that the currently named dependencies are malicious. The vulnerability is that their identities and contents are not reproducibly constrained or verified. ### Attack Path 1. An attacker compromises a referenced package, its maintainer account, or the associated package registry. 2. Alternatively, an unsafe or incompatible new release is published under one of the referenced names. 3. A user follows the project documentation or runs `install.sh`. 4. `pip` or `npx` downloads the mutable package release. 5. Package-controlled installation logic executes with the privileges of the user running the installer. 6. Errors can be hidden by `2> ...[truncated 744 chars]- Remediation
View remediation
/dev/null || true`; terminate installation when dependency installation fails. 7. Verify package origin, ownership, and signatures where the package ecosystem supports them. 8. Run dependency vulnerability and provenance checks in CI before publishing. ]]>