T08 · Insecure Dependencies
Warning
- Location
- README.md:16
- Finding
- Unpinned npm Package Execution Through npx## Vulnerability Details **File Location**: `README.md`, line 16 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Complete Code Snippet**: ```bash npx clawhub@latest install roundtable ``` ### Technical Analysis The documented installation command instructs `npx` to resolve, download, and execute the `clawhub` package identified by the mutable `latest` distribution tag. It does not pin the dependency to a reviewed version or integrity hash. Because `latest` may point to a different release after this Skill has been audited, the effective code executed during installation is not fixed by the repository. npm package code and applicable lifecycle behavior execute with the invoking user's privileges. This creates a supply-chain boundary in which compromise of the package, a maintainer account, the release process, or an upstream dependency could result in execution of unreviewed code. This finding concerns the installation guidance. The audited project itself contains only Markdown files and does not include an embedded executable payload. ### Attack Path 1. An attacker compromises the `clawhub` package, its publisher account, its release pipeline, or a dependency included in a subsequent release. 2. The attacker publishes a malicious version and causes the mutable `latest` tag to resolve to it. 3. A user follows the installation command from `README.md`. 4. `npx` downloads and executes package-controlled code without enforcing the version reviewed during this audit. 5. Malicious code runs under the privileges and environment of the user who invoked the command. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the installing user's privileges. Depending on those privileges and the host environment, the malicious package could access user-readable files and credentials, alter project files, make network requests, install persistence, or modify other r ...[truncated 305 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the mutable `latest` tag with an explicitly reviewed package version, for example: ```bash npx clawhub@<reviewed-version> install roundtable ``` 2. Record and verify package provenance and integrity through a trusted lockfile, registry policy, checksum, signature, or npm provenance mechanism where supported. 3. Review the selected package version, its transitive dependencies, and relevant lifecycle scripts before recommending execution. 4. Prefer a workflow that downloads and verifies the package before executing it when operationally feasible. 5. Run installation with the minimum necessary privileges in an isolated environment; do not invoke it as an administrator or root user. 6. Use an approved registry and dependency allowlist in managed environments to reduce package substitution and account-compromise risks.