T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/setup.sh:56- Finding
Execution of an Unpinned Remote Installation Script
- Content
View full analysis
/dev/null || sudo mv bin/arduino-cli /usr/local/bin/ rm -rf bin/ ;; macos) if command -v brew >/dev/null 2>&1; then brew install arduino-cli else curl -fsSL https://raw.githubusercontent.com/arduino/arduino-cli/master/install.sh | sh sudo mv bin/arduino-cli /usr/local/bin/ rm -rf bin/ fi ;; ``` ### Technical Analysis The setup script downloads the Arduino CLI installer from the mutable `master` branch and pipes it directly into a shell. Although the URL belongs to Arduino's official GitHub organization, its contents are not pinned to a reviewed commit or release. The script is executed without prior inspection, checksum verification, or signature validation. This creates a time-of-check/time-of-use supply-chain boundary: the effective code executed during installation can differ from the code reviewed in this project. The resulting executable may also be moved into `/usr/local/bin` with `sudo`, increasing the consequences of a compromised payload. Installing Arduino CLI is necessary for the declared functionality, but executing mutable network content directly is not the minimum-risk method required to accomplish that task. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, the release workflow, or another part of the delivery chain. 2. The attacker modifies `master/install.sh ...[truncated 902 chars]- Remediation
View remediation