T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/bootstrap.sh:5- Finding
Mutable Remote Repository Is Downloaded, Installed, and Executed Without Integrity Verification
- Content
View full analysis
/dev/null 2>&1; then if [ -d "$PROJECT_DIR/.git" ]; then echo ">> Updating repo in $PROJECT_DIR" git -C "$PROJECT_DIR" pull --ff-only else echo ">> Cloning repo into $PROJECT_DIR" git clone "$REPO_URL" "$PROJECT_DIR" fi ``` ```bash echo ">> Git not available. Downloading zip to $PROJECT_DIR" mkdir -p "$PROJECT_DIR" tmp_zip="$(mktemp -t agentic_paper_digest.XXXXXX).zip" if command -v curl >/dev/null 2>&1; then curl -L "$ZIP_URL" -o "$tmp_zip" elif command -v wget >/dev/null 2>&1; then wget -O "$tmp_zip" "$ZIP_URL" else "$PY_BIN" - "$ZIP_URL" "$tmp_zip" <<'PY' import sys import urllib.request url, out = sys.argv[1], sys.argv[2] urllib.request.urlretrieve(url, out) PY fi tmp_dir="$(mktemp -d)" if command -v unzip >/dev/null 2>&1; then unzip -q "$tmp_zip" -d "$tmp_dir" else "$PY_BIN" - "$tmp_zip" "$tmp_dir" <<'PY' import sys import zipfile zipfile.ZipFile(sys.argv[1]).extractall(sys.argv[2]) PY fi src_dir="$tmp_dir/agentic_paper_digest-main" if [ ! -d "$src_dir" ]; then echo "Downloaded archive did not contain expected folder: $src_dir" exit 1 fi cp -R "$src_dir/." "$PROJECT_DIR/" rm -rf "$tmp_zip" "$tmp_dir" ``` ```bash echo ">> Installing Python deps" pip install -r requirements.txt ``` The retrieved module is subsequently executed by the launchers: ```bash python -m ...[truncated 2333 chars]- Remediation
View remediation