T08 · Insecure Dependencies
Warning
- Location
- PUBLISHING.md:70
- Finding
- Unpinned npm CLI Execution in Publishing Workflow## Vulnerability Details **File Location**: `PUBLISHING.md`, lines 70-98 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium The publishing instructions direct maintainers to invoke the `clawhub` npm package through `npx` without specifying a reviewed version, using a committed lockfile, or validating package integrity. **Complete vulnerable code segment:** ```markdown ## 4. Publish Prerequisites ClawHub CLI is the recommended publishing path. On this machine, `npx clawhub` failed under Node `v22.22.0` with a module compatibility error from `mime`. Before publishing, switch to an LTS Node version such as Node 20: ```bash node -v nvm use 20 ``` If you do not use `nvm`, use your preferred Node version manager and make sure `node -v` reports an LTS release before continuing. ## 5. Publish To ClawHub Log in: ```bash npx clawhub login ``` Publish from the repository root: ```bash npx clawhub publish ``` If the CLI supports additional options in your installed version, inspect them with: ```bash npx clawhub publish --help ``` ``` ### Technical Analysis When an npm package is not already available locally, `npx` can download the package resolved by the configured npm registry and immediately execute its code. The commands do not pin `clawhub` to a specific reviewed version and are not protected by a project lockfile or an integrity-verification step. Consequently, the effective executable can change after this project has been reviewed. A compromised package release, maintainer account, registry response, or dependency in the package's transitive dependency graph could result in arbitrary code execution. The exposure is particularly relevant because the documented workflow performs authentication and publication operations. This finding does not establish that the current `clawhub` package is malicious. It identifies an unsafe supply-chain execution pa ...[truncated 1581 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to a reviewed, explicit version rather than resolving the latest available release: ```bash npx --yes clawhub@<reviewed-version> login npx --yes clawhub@<reviewed-version> publish npx --yes clawhub@<reviewed-version> publish --help ``` 2. Prefer installing the reviewed CLI as a project development dependency and commit the generated lockfile: ```bash npm install --save-dev --save-exact clawhub@<reviewed-version> npm exec -- clawhub login npm exec -- clawhub publish ``` 3. Use deterministic installation in automated publishing environments, such as `npm ci`, and reject unexpected lockfile changes. 4. Verify the package name, expected publisher, registry URL, package provenance, and integrity metadata before installation or execution. 5. Review dependency updates before changing the pinned version. Use dependency scanning and provenance or signature verification where supported. 6. Run publication from an isolated, minimally privileged environment with narrowly scoped and short-lived credentials. Do not invoke the publishing CLI with administrator or root privileges. 7. Protect release credentials from unnecessary process access and rotate them immediately if a package compromise is suspected.