T08 · Insecure Dependencies
Warning
- Location
- README.md:42
- Finding
- Unpinned npm Package Execution in Installation Instructions## Vulnerability Details **File Location**: `README.md`, lines 42-46 **Vulnerability Type**: Supply-chain risk caused by executing a mutable third-party package version **Risk Level**: Medium ### Vulnerable Code ```markdown Install from ClawHub: ```bash npx clawhub@latest install cementops-safety-training ``` ``` ### Technical Analysis The installation instructions invoke `npx` with the mutable version selector `clawhub@latest`. When a user follows these instructions, npm may download and immediately execute whichever package release is currently associated with the `latest` distribution tag. The effective installer code is therefore not fixed to the version reviewed during this audit. If the package publisher account, npm package, release process, or one of its executable dependencies is compromised, a malicious release could be served without requiring any modification to this repository. This is classified as `T08: Insecure Dependencies` because the risk originates from an unpinned third-party supply-chain component. The project itself contains no confirmed malicious scripts, and exploitation requires a user to execute the documented command. ### Attack Path 1. An attacker compromises the npm publisher account, release pipeline, package contents, or a relevant dependency for `clawhub`. 2. The attacker publishes a malicious package version and assigns or causes it to receive the `latest` distribution tag. 3. A user follows the Quick Start instructions and runs `npx clawhub@latest install cementops-safety-training`. 4. npm resolves the mutable `latest` tag and downloads the attacker-controlled release. 5. `npx` executes the package CLI and any applicable lifecycle behavior with the privileges of the invoking user. 6. The malicious package can access or modify resources available to that user. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the account that runs t ...[truncated 610 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version: ```bash npx clawhub@1.2.3 install cementops-safety-training ``` 2. Verify and document the expected npm package publisher, registry, and package provenance. 3. Use npm provenance attestations, signed releases, or an equivalent trusted-release verification mechanism where supported. 4. Publish and verify a checksum or integrity value for the reviewed installer artifact. 5. In automated environments, use a lockfile or another reproducible dependency mechanism rather than resolving mutable distribution tags. 6. Review package lifecycle scripts and the resolved dependency tree before approving future installer versions. 7. Advise users not to run the installer with administrative privileges unless explicitly required and justified. 8. Establish a controlled version-update process in which new releases are audited before the documented version is changed.