T08 · Insecure Dependencies
Warning
- Location
- README.md:47
- Finding
- Unpinned Package Execution Through the Documented Installation Command## Vulnerability Details **File Location**: `README.md:47-53` **Vulnerability Type**: Unpinned third-party dependency and mutable supply-chain execution **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ### Method 1: Install via ClaWhub (Recommended) Visit the Skill page: [clawhub.ai/maye08/celestchart-daily](https://clawhub.ai/maye08/celestchart-daily) ```bash npx clawhub@latest install celestchart-daily ``` ``` ### Technical Analysis The documented installation procedure directs users to execute `clawhub@latest` through `npx`. The `latest` distribution tag is mutable and does not identify a specific reviewed package version. Depending on the local npm configuration and cache state, `npx` can download the package from the configured registry and immediately execute its entry point. Consequently, the code executed by this command can differ from the version that existed when the skill was audited. The command also lacks an integrity hash, lockfile, signature check, or other mechanism that would allow the user to verify that the downloaded package is the reviewed artifact. There is no evidence in the audited project that the current `clawhub` package is malicious. The vulnerability is the unsafe dependency-selection practice: a compromised package publisher, registry account, distribution tag, or future release could turn the documented installation command into a remote code-execution path. ### Attack Path 1. An attacker compromises the package publisher account, publishing pipeline, registry entry, or another mechanism controlling the `clawhub` package's `latest` tag. 2. The attacker publishes a malicious release and assigns that release to `latest`. 3. A user follows the recommended installation instructions and runs `npx clawhub@latest install celestchart-daily`. 4. `npx` resolves the mutable `latest` tag and downloads the attacker-controlled package. 5. The package's executable code runs under ...[truncated 1005 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the mutable `latest` tag with a specific version that has been reviewed: ```bash npx clawhub@<reviewed-version> install celestchart-daily ``` 2. Publish and verify the expected package integrity digest or cryptographic signature before execution. 3. Use a lockfile or another reproducible installation mechanism where supported. 4. Document the expected package source, exact version, and verification procedure so users can detect registry or package substitution. 5. Review each dependency update before changing the pinned version. 6. Where practical, install the package first without running lifecycle scripts, inspect it, and only then execute the reviewed entry point in a restricted environment. 7. Avoid recommending elevated execution such as `sudo`; installation should occur with the minimum required user privileges.