T08 · Insecure Dependencies
- Location
PUBLISHING.md:70- Finding
Unpinned npm CLI Execution in Publishing Workflow
- Content
View full analysis
Vulnerability Details
File Location:
PUBLISHING.md, lines 70-98
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: MediumThe publishing instructions direct maintainers to invoke the
clawhubnpm package throughnpxwithout specifying a reviewed version, using a committed lockfile, or validating package integrity.Complete vulnerable code segment:
markdown ## 4. Publish Prerequisites ClawHub CLI is the recommended publishing path. On this machine, `npx clawhub` failed under Node `v22.22.0` with a module compatibility error from `mime`. Before publishing, switch to an LTS Node version such as Node 20: ```bash node -v nvm use 20If you do not use
nvm, use your preferred Node version manager and make surenode -vreports an LTS release before continuing.5. Publish To ClawHub
Log in:
bash npx clawhub loginPublish from the repository root:
bash npx clawhub publishIf the CLI supports additional options in your installed version, inspect them with:
bash npx clawhub publish --helptext ### Technical Analysis When an npm package is not already available locally, `npx` can download the package resolved by the configured npm registry and immediately execute its code. The commands do not pin `clawhub` to a specific reviewed version and are not protected by a project lockfile or an integrity-verification step. Consequently, the effective executable can change after this project has been reviewed. A compromised package release, maintainer account, registry response, or dependency in the package's transitive dependency graph could result in arbitrary code execution. The exposure is particularly relevant because the documented workflow performs authentication and publication operations. This finding does not establish that the current `clawhub` package is malicious. It identifies an unsafe supply-chain execution pa ...[truncated 1581 chars]- Remediation
View remediation
Remediation Suggestions
-
Pin the CLI to a reviewed, explicit version rather than resolving the latest available release:
bash npx --yes clawhub@<reviewed-version> login npx --yes clawhub@<reviewed-version> publish npx --yes clawhub@<reviewed-version> publish --help -
Prefer installing the reviewed CLI as a project development dependency and commit the generated lockfile:
bash npm install --save-dev --save-exact clawhub@<reviewed-version> npm exec -- clawhub login npm exec -- clawhub publish -
Use deterministic installation in automated publishing environments, such as
npm ci, and reject unexpected lockfile changes. -
Verify the package name, expected publisher, registry URL, package provenance, and integrity metadata before installation or execution.
-
Review dependency updates before changing the pinned version. Use dependency scanning and provenance or signature verification where supported.
-
Run publication from an isolated, minimally privileged environment with narrowly scoped and short-lived credentials. Do not invoke the publishing CLI with administrator or root privileges.
-
Protect release credentials from unnecessary process access and rotate them immediately if a package compromise is suspected.
-