T08 · Insecure Dependencies
Warning
- Location
- README.md:50
- Finding
- Unpinned Package Execution Through npx<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, line 50 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash npx clawhub install h1b-finder ``` ### Technical Analysis The documented installation command invokes `clawhub` through `npx` without specifying a package version or integrity value. If the package is not already available locally, `npx` may retrieve the currently published package from the configured npm registry and execute it with the invoking user's privileges. Because the command does not pin a reviewed release, the code executed during installation can change after this skill has been audited. Exploitation requires the upstream package, publisher account, package-resolution path, or configured registry to be compromised or maliciously altered. The audited project itself does not contain an embedded malicious payload. ### Attack Path 1. An attacker compromises the npm publisher account, package, registry path, or another component involved in resolving `clawhub`. 2. The attacker publishes or serves a malicious release under the expected package name. 3. A user follows the README and runs `npx clawhub install h1b-finder`. 4. `npx` resolves and downloads the attacker-controlled release because no specific reviewed version is required. 5. The malicious package executes under the user's account and can perform actions permitted to that account. ### Impact Assessment Successful exploitation could allow arbitrary code execution with the privileges of the user running the installation command. Depending on those privileges and the local environment, the malicious dependency could read or modify user-accessible files, access environment variables and credentials, alter development configuration, or initiate outbound network connections. The immediate scope is the installing user's account and any resources accessible to it. Greater impact is possible if the command i ...[truncated 126 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Pin `clawhub` to a specific reviewed version, for example: ```bash npx clawhub@<reviewed-version> install h1b-finder ``` - Verify the selected release against an expected integrity hash or trusted lockfile before execution. - Document the expected npm publisher and official registry source so users can validate package provenance. - Avoid automatically accepting a newer package version during installation. - In CI or other sensitive environments, install dependencies from a controlled registry or verified artifact mirror and execute them with minimal privileges. - Review and update the pinned version through a controlled dependency-upgrade process rather than tracking the latest release implicitly. ]]>