T08 · Insecure Dependencies
Warning
- Location
README.md:14- Finding
Unpinned npm Package Execution in English Installation Instructions
- Content
View full analysis
Vulnerability Details
File Location:
README.md, lines 14–18
Vulnerability Type: Unpinned third-party package execution
Risk Level: MediumVulnerable Code
markdown ## Install ```bash npx clawhub install maxhub-wechattext ### Technical Analysis The installation instructions invoke `clawhub` through `npx` without specifying a reviewed version or integrity constraint. If the package is not already available locally, `npx` may retrieve the currently resolved package from the npm registry and execute it immediately. Because dependency resolution is mutable, the code executed when a user follows this instruction may differ from the package version available when the Skill was audited. Compromise of the npm package, its publisher account, or the relevant registry resolution path could therefore introduce arbitrary installation-time behavior. The command does not by itself demonstrate malicious intent, but it creates an avoidable supply-chain trust boundary and permits remote package code outside this repository to execute with the invoking user's privileges. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or another component capable of affecting package resolution. 2. The attacker publishes a malicious version under the package name resolved by `npx`. 3. A user follows the documented installation command. 4. `npx` downloads the mutable package version and executes its package code. 5. The malicious code runs under the user's account before or during installation. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user running the installation command. Depending on that user's permissions and environment, the malicious package could: - Read files accessible to the user. - Access environment variables and locally stored credentials. - Modify user-owned configuration or executable files. - Install additional packages or persistence mecha ...[truncated 215 chars]- Remediation
View remediation
Remediation Suggestions
- Pin
clawhubto an explicitly reviewed version, for example:
bash npx clawhub@1.2.3 install maxhub-wechat- Review the pinned package version and its transitive dependencies before recommending it.
- Where supported, verify package provenance, signatures, or published integrity metadata.
- Prefer a lockfile-backed or otherwise reproducible installation workflow.
- Document the expected publisher and registry so users can detect package substitution.
- Avoid recommending
npxwith an unqualified package name for security-sensitive installations.
- Pin