T08 · Insecure Dependencies
Warning
- Location
setup/tools/clawdhub_publish.sh:22- Finding
Runtime Installation and Immediate Execution of Unverified npm Dependencies
- Content
View full analysis
/dev/null 2>&1 # undici: clawdhub 0.3.0 imports it but does not declare it; keeps CLI working on current Node. npm install clawdhub@0.3.0 undici@6 >/dev/null 2>&1 # clawdhub 0.3.x hardcodes REQUEST_TIMEOUT_MS = 15_000 in dist/http.js. Multi-file # skill uploads routinely exceed 15s (multipart + registry processing), which # surfaces as: Non-error was thrown: "Timeout". Patch the temp install only. HTTP_JS="$TMP/node_modules/clawdhub/dist/http.js" if [[ -f "$HTTP_JS" ]]; then python3 -c " from pathlib import Path import sys path = Path(sys.argv[1]) text = path.read_text(encoding='utf-8') old = 'const REQUEST_TIMEOUT_MS = 15_000' new = 'const REQUEST_TIMEOUT_MS = 180_000' if old not in text: print('clawdhub_publish: expected timeout line not found; skipping patch', file=sys.stderr) sys.exit(0) text = text.replace(old, new, 1) # Undici H2 is experimental on some Node builds; disable to reduce flaky connects. text = text.replace('allowH2: true', 'allowH2: false', 1) path.write_text(text, encoding='utf-8') " "$HTTP_JS" fi exec "$TMP/node_modules/.bin/clawdhub" publish "$REPO_ROOT" \ --slug tai-alpha-stock \ --name "Tai Alpha Stock" \ --version "$VERSION" \ --changelog "$CHANGELOG" \ "$@" ``` ### Technical Analysis The publishing helper resolves packages from the npm registry each time it runs and immediately executes the downloaded `clawdhub` binary. Although `clawdhub` is pinned to version `0.3.0`, no previously reviewed lockfile or package-integrity value is supplied. The `undici@6` dependency is constrained only to a major version, and transitive dependencies are resolved according to the registry state at execution time. Package installation may also execute npm lifecycle scripts. Co ...[truncated 2039 chars]- Remediation
View remediation