T08 · Insecure Dependencies
Warning
- Location
- README.md:124
- Finding
- Unpinned Mutable Package Execution in Installation Documentation<![CDATA[ ## Vulnerability Details **File Location**: `README.md:124` and duplicated content at `triz/README.md:124` **Vulnerability Type**: Supply-chain risk caused by executing an unpinned package release **Risk Level**: Medium ### Vulnerable Code ```bash npx clawhub@latest install triz ``` ### Technical Analysis The documented installation command instructs users to download and execute the package currently associated with the mutable `latest` tag. It does not pin an audited version or provide an integrity hash. Consequently, the code executed during installation can differ from the code that was reviewed. If the upstream package, maintainer account, registry entry, or release process is compromised, an attacker could replace the effective installation payload without modifying this repository. No malicious dependency or remote payload was found in the audited project itself. The risk is specifically introduced by the documented use of an unpinned external package execution path. ### Attack Path 1. An attacker compromises the upstream `clawhub` package, its publisher credentials, or the relevant package-registry release process. 2. The attacker publishes a malicious release and assigns it to the `latest` distribution tag. 3. A user follows the installation instructions and runs `npx clawhub@latest install triz`. 4. `npx` downloads and executes the attacker-controlled package release. 5. The malicious package or its lifecycle code executes with the permissions of the user running the command. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope could include files, credentials, environment variables, network resources, and applications available to that user. The command does not inherently grant administrative privileges, so privilege escalation beyond the invoking account would require a separate vulnerability or the user to run the command with elevated p ...[truncated 15 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the mutable tag with an exact, audited package version, for example: ```bash npx clawhub@1.2.3 install triz ``` 2. Publish and document an expected integrity digest or signature, and require verification before execution. 3. Avoid package lifecycle scripts unless strictly necessary, and document every script that executes during installation. 4. Prefer a reviewed local installation path using the included `install.sh` when appropriate. 5. Add dependency and publisher-account monitoring so unexpected releases or distribution-tag changes are detected. 6. Apply the same correction to both `README.md` and `triz/README.md`. ]]>