T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unpinned Third-Party npm Package Installed with Registrar Credentials## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw": {"requires": {"bins": ["node", "npm"], "env": ["NAMECOM_USERNAME", "NAMECOM_TOKEN"], "envOptional": ["NAMECOM_USERNAME_TEST", "NAMECOM_TOKEN_TEST"]}, "primaryEnv": "NAMECOM_TOKEN", "homepage": "https://github.com/patramsey/namecom-clawbot", "install": [{"id": "node", "kind": "node", "package": "namecom-clawbot", "bins": ["namecom-clawbot"], "label": "Install namecom-clawbot MCP server (npm)"}]}} ``` ### Technical Analysis The installation metadata identifies `namecom-clawbot` only by its npm package name. It does not pin an exact audited version or specify an integrity hash. Consequently, installation can resolve to a future package release whose contents differ from those reviewed during this audit. The package is intended to execute with access to `NAMECOM_USERNAME` and `NAMECOM_TOKEN`. According to the skill documentation, the Name.com token does not support per-operation scopes and can perform sensitive registrar and DNS operations. Although `SKILL.md` states that the package uses signed npm provenance, provenance establishes a relationship with a build source; it does not guarantee that every future source change or release is trustworthy. The executable package source was not included in the audited project, so its implementation and the documented purchase-confirmation gate could not be independently verified. This is a supply-chain exposure rather than evidence that the currently published package is malicious. ### Attack Path 1. An attacker compromises the npm publisher account, release workflow, source repository, or another component used to publish `namecom-clawbot`. 2. The attacker publishes a malicious release under the same npm package name. 3. A user or automated host installs the dependency without an exact version and ...[truncated 1463 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `namecom-clawbot` to an exact version that has been reviewed, rather than allowing npm to resolve an unspecified release. 2. Enforce the expected package integrity digest through a lockfile or equivalent verified installation mechanism. 3. Vendor or otherwise retain the reviewed executable source so the deployed implementation can be compared with the audited version. 4. Verify npm provenance, release signatures, repository tags, and build workflow identity before installation; do not treat provenance alone as a security review. 5. Pin and audit transitive dependencies and use reproducible, immutable builds. 6. Run the MCP server as a dedicated, unprivileged operating-system user inside a container or similarly isolated environment. 7. Expose only the required Name.com credentials to the process and prevent access to unrelated environment variables, files, and host services. 8. Apply Name.com API IP whitelisting and use sandbox credentials during validation. 9. Prefer limited account credit or a payment method with spending limits and alerts to reduce financial exposure. 10. Independently inspect and test the package implementation, particularly the claimed purchase-token gate, before enabling production credentials.