T08 · Insecure Dependencies
Warning
- Location
- PUBLISH.md:5
- Finding
- Unpinned Global Installation of the ClawHub Publishing CLI<![CDATA[ ## Vulnerability Details **File Location**: `PUBLISH.md`, line 5 **Vulnerability Type**: Unpinned third-party publishing dependency **Risk Level**: Medium ### Vulnerable Code ```markdown 1. **ClawHub CLI** — `npm install -g clawhub` ``` ### Technical Analysis The documented publishing workflow installs the mutable latest release of the `clawhub` npm package globally. It does not specify a reviewed version, lock an integrity hash, or require provenance verification. An npm installation can execute package lifecycle scripts with the privileges of the user running npm. In addition, the installed CLI is subsequently trusted to authenticate the publisher and assemble or publish a release. A compromised package release, npm maintainer account, or dependency in the CLI's transitive dependency graph could therefore introduce malicious code after this project has been reviewed. ### Attack Path 1. An attacker compromises the `clawhub` npm package, one of its dependencies, or an authorized publisher account. 2. The attacker publishes a malicious version under the same package name. 3. A project publisher follows the documented `npm install -g clawhub` command. 4. npm retrieves the current compromised release and may execute its lifecycle scripts. 5. The malicious package executes with the publisher's user privileges or acts maliciously when the installed CLI is invoked. 6. It may access files available to that user, steal publishing credentials, modify the release bundle, or publish attacker-controlled content. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the publisher account. The affected scope may include the publisher's local files, environment variables, npm or ClawHub authentication material, source repositories, and release artifacts. If the command is run with elevated privileges, the impact would extend to those elevated privileges. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions - Pin the CLI to a specific reviewed version, for example: ```bash npm install -g clawhub@0.7.0 ``` - Prefer a project-local development dependency governed by a committed lockfile instead of a global installation. - Use `npm ci` with a reviewed lockfile where the publishing environment permits it. - Verify npm package provenance, signatures, publisher identity, and expected integrity metadata before installation. - Run the publishing tool in an isolated, minimally privileged environment without unrelated credentials or sensitive files. - Establish a controlled dependency-update process in which version changes are reviewed and tested before use. ]]>