T08 · Insecure Dependencies
Warning
- Location
- README.md:18
- Finding
- Unpinned Package Execution Through npx## Vulnerability Details **File Location**: `README.md:18` **Vulnerability Type**: Unpinned third-party installer execution **Risk Level**: Medium ### Vulnerable Code ```bash npx clawhub install deals-hunter ``` ### Technical Analysis The documented installation procedure invokes `clawhub` through `npx` without specifying an exact package version or verifying package integrity. If the package is not already available locally, `npx` can download and execute the package currently published under that name. Consequently, the code executed by this command is mutable and is not necessarily the same code that was reviewed during this audit. A compromised package publisher, registry account, dependency chain, or newly published malicious release could alter installation behavior after the skill has been audited. This finding does not establish that the current `clawhub` package is malicious. The vulnerability is the absence of version and integrity controls around code that may execute during installation. ### Attack Path 1. An attacker compromises the package publisher, registry entry, or a dependency used by the `clawhub` package. 2. The attacker publishes a malicious version under the same package name. 3. A user follows the README and runs `npx clawhub install deals-hunter`. 4. `npx` resolves and downloads the mutable package release. 5. Package initialization or installer code executes under the invoking user's account. 6. The malicious release can access resources available to that user, subject to operating-system controls. ### Impact Assessment Successful exploitation could provide code execution with the privileges of the user running the installation command. Depending on that user's permissions, the malicious package could read or alter user-accessible files, environment variables, application configuration, API credentials, or workspace data. The issue does not directly provide elevated operating-system p ...[truncated 161 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installer to a reviewed exact version, for example: ```bash npx --yes clawhub@<reviewed-exact-version> install deals-hunter ``` 2. Document the expected package registry and publisher identity. 3. Use lockfiles and package integrity hashes where the installation workflow supports them. 4. Prefer installing a verified package version before execution rather than allowing implicit retrieval of the latest release. 5. Run installation under a least-privileged account without unnecessary secrets in its environment. 6. Re-audit the installer and its dependency tree whenever the pinned version is updated.