T08 · Insecure Dependencies
Error
- Location
scripts/read-setup.sh:17- Finding
Unpinned npm Packages Execute Lifecycle Scripts Before Review
- Content
View full analysis
&2 \ || out_err "fetching $pkg failed (see stderr)" else log=$(mktemp) if ! npm install --prefix "$npm_root" --no-audit --no-fund "$pkg" >"$log" 2>&1; then cat "$log" >&2 rm -f "$log" out_err "fetching $pkg failed (set NPM_DEBUG=1 to see full output)" fi rm -f "$log" fi ``` `scripts/install-sensor.sh:164-172`: ```bash # Step 1: ensure the sensor package is installed under the W2A npm root. npm_root=$(w2a_npm_root) mkdir -p "$npm_root" log=$(mktemp) if ! npm install --prefix "$npm_root" --no-audit --no-fund "$pkg" >"$log" 2>&1; then cat "$log" >&2; rm -f "$log" out_err "fetching $pkg failed" fi rm -f "$log" ``` `scripts/bootstrap.sh:23-36`: ```bash # Step 1: binary on PATH. If missing, auto-install the bridge package globally # via npm. The agent will surface npm's stderr (sudo prompt, EACCES, etc.) so # the user can re-run with elevated rights if needed. binary_status="present" if ! command -v world2agent-openclaw-supervisor >/dev/null 2>&1 \ || ! command -v world2agent-openclaw-runner >/dev/null 2>&1; then command -v npm >/dev/null 2>&1 \ || out_err "world2agent-openclaw-supervisor not on PATH and 'npm' is unavailable; install Node.js + npm first, or install the bridge runtime manually" printf '[bootstrap] installing @world2agent/openclaw-sensor-bridge globally...\n' >&2 install_log=$(mktemp) if ! npm install -g @world2agent/openclaw-sensor-bridge >"$install_log" 2>&1; then cat "$install_log" >&2 rm -f "$install_log" ...[truncated 2999 chars]- Remediation
View remediation