T08 · Insecure Dependencies
- Location
scripts/send-task.sh:8- Finding
Runtime Execution of an Undeclared Package Through npx
- Content
View full analysis
Vulnerability Details
File Location:
scripts/send-task.sh, lines 8-11
Vulnerability Type: Runtime dependency retrieval and execution
Risk Level: MediumVulnerable Code
bash if [ -f "$PROJECT_DIR/dist/main.js" ]; then node "$PROJECT_DIR/dist/main.js" "$@" else npx --prefix "$PROJECT_DIR" tsx "$PROJECT_DIR/src/main.ts" "$@" fiTechnical Analysis
When
dist/main.jsis absent, the wrapper invokestsxthroughnpx. However,tsxis not declared as a direct dependency or development dependency inpackage.json, and it is not a direct importer dependency inpnpm-lock.yaml.Consequently, a suitable local
tsxexecutable is not guaranteed to exist. Depending on the installed npm version and configuration,npxmay retrievetsxfrom the configured package registry and execute it immediately. The effective code executed by the Skill is therefore not fully constrained by the reviewed source tree or project lockfile.The audited artifact does not contain the
dist/directory, so this fallback is relevant to direct execution of the supplied artifact. This is a supply-chain weakness rather than evidence that the currenttsxpackage is malicious.Attack Path
- An operator invokes
scripts/send-task.sh. - The script checks for
dist/main.js; it is absent from the audited artifact. - The script executes
npx --prefix "$PROJECT_DIR" tsx .... - No direct, lockfile-governed
tsxdependency is guaranteed to be available locally. npxresolves the executable using npm configuration and may download it from a configured registry.- A compromised registry, malicious registry override, or package substitution supplies attacker-controlled package code.
- The downloaded package executes with the privileges and environment of the Skill process.
Impact Assessment
Successful exploitation could provide arbitrary code execution under the account running OpenClaw or the Skill. The executed package could acces ...[truncated 420 chars]
- An operator invokes
- Remediation
View remediation
Remediation Suggestions
- Add
tsxas an explicit dependency at an exact reviewed version:
json { "devDependencies": { "tsx": "4.x.y" } }- Regenerate and commit the lockfile, and install dependencies using a frozen lockfile:
bash pnpm install --frozen-lockfile- Prevent
npxfrom installing missing packages at runtime. For example:
bash if [ -f "$PROJECT_DIR/dist/main.js" ]; then exec node "$PROJECT_DIR/dist/main.js" "$@" elif [ -x "$PROJECT_DIR/node_modules/.bin/tsx" ]; then exec "$PROJECT_DIR/node_modules/.bin/tsx" "$PROJECT_DIR/src/main.ts" "$@" else echo "Error: dist/main.js and the local tsx executable are unavailable." >&2 exit 1 fi-
Prefer distributing and executing a prebuilt
dist/main.jsfor production installations, eliminating the TypeScript runtime dependency. -
In CI and release workflows, verify that
dist/main.jsis present and built from reviewed source before publishing the Skill. -
Restrict npm registry configuration to trusted registries and use integrity-checked, lockfile-controlled installations.
- Add