T08 · Insecure Dependencies
Warning
- Location
- references/installation.md:13
- Finding
- Unpinned Third-Party Package Installations## Vulnerability Details **File Location**: `references/installation.md:13-20`; `references/sdk-and-protocol.md:39-44` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code Snippets From `references/installation.md:13-20`: ```sh Use one of the supported package routes: ```sh npm install -g open-browser-use ``` ```sh brew install iFurySt/open-browser-use/open-browser-use ``` ``` From `references/sdk-and-protocol.md:39-44`: ```sh Install the SDK package from the package registry for your runtime: ```sh npm install open-browser-use-sdk pip install open-browser-use-sdk go get github.com/ifuryst/open-codex-browser-use/packages/open-browser-use-go ``` ``` ### Technical Analysis The installation instructions do not pin an exact npm or Python package version, Go commit or release tag, or Homebrew formula revision. Consequently, the installed artifact depends on the mutable state of external package registries and repositories at installation time. This is particularly security-sensitive because Open Browser Use is designed to install a native messaging host and interact with a privileged Chrome extension. The documented capabilities include Chrome tab control, history access, Chrome DevTools Protocol execution, downloads, local file selection, and clipboard operations. If an upstream package, maintainer account, release process, registry namespace, or repository is compromised, users following these commands could install a modified version without the reviewed Skill files changing. npm package lifecycle behavior and other package installation mechanisms may also execute package-controlled installation logic. ### Attack Path 1. An attacker compromises an upstream maintainer account, package registry entry, repository, or package publication process. 2. The attacker publishes a malicious version under one of the documented package identities or modifies the version resolved by an unpinned installation. 3. A us ...[truncated 1103 chars]
- Remediation
- ## Remediation Suggestions 1. Pin npm and Python dependencies to exact, reviewed versions: ```sh npm install -g open-browser-use@<reviewed-version> npm install open-browser-use-sdk@<reviewed-version> pip install open-browser-use-sdk==<reviewed-version> ``` 2. Pin the Go dependency to a reviewed semantic version or immutable commit: ```sh go get github.com/ifuryst/open-codex-browser-use/packages/open-browser-use-go@<reviewed-version-or-commit> ``` 3. Document the expected Homebrew formula version and verify the resolved formula and artifact before installation. 4. Publish SHA-256 checksums or cryptographic signatures for release artifacts and require verification before setup. 5. Document the canonical package-registry namespaces, repository URL, publisher identities, and expected signing keys. 6. Use lockfiles and package-manager integrity metadata in reproducible integrations. 7. Recommend installation under least privilege and prohibit unnecessary use of elevated privileges. 8. Establish a dependency review and update process so pinned versions are upgraded only after source and artifact verification.