T08 · Insecure Dependencies
Warning
- Location
- README.md:27
- Finding
- Unpinned npx Installers Retrieve and Execute Mutable Third-Party Content<![CDATA[ ## Vulnerability Details **File Location**: `README.md:27-35`; `SKILL.md:57-60` **Vulnerability Type**: Untrusted and mutable dependency installation **Risk Level**: Medium ### Vulnerable Code `README.md:27-35`: ```bash npx add https://github.com/wpank/ai/tree/main/skills/frontend/native-ui ``` ```bash npx clawhub@latest install native-ui ``` `SKILL.md:57-60`: ```bash npx clawhub@latest install native-ui ``` ### Technical Analysis The installation instructions invoke packages through `npx`, which can download and execute package code, including CLI entry points and potentially package lifecycle scripts. The commands do not pin all retrieved content to immutable, independently verifiable artifacts: - The GitHub source references the mutable `main` branch rather than a commit hash. - `clawhub@latest` explicitly selects a mutable package release. - No checksum, signature, or integrity value is provided. Consequently, the code ultimately installed or executed can differ from the artifact reviewed during this audit. This creates a supply-chain trust boundary in which compromise of the npm package, registry account, GitHub account, repository, branch, or transitive dependency may result in execution of substituted code. No compromise or malicious remote payload was observed in the audited files. The vulnerability is the unsafe installation pattern and lack of immutable dependency verification. ### Attack Path 1. An attacker compromises the relevant package publisher, registry entry, GitHub account, repository, or one of its dependencies. 2. The attacker publishes a malicious `latest` package release or modifies content on the referenced `main` branch. 3. A user follows the documented installation command. 4. `npx` downloads the current remote package or installer rather than an immutable reviewed artifact. 5. The malicious CLI code or lifecycle script executes with the privileges of the user running the command. 6. The payload can access resou ...[truncated 690 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `clawhub@latest` with a reviewed, exact package version. 2. Pin GitHub installations to a full commit SHA instead of the mutable `main` branch. 3. Publish and verify cryptographic checksums or signed release attestations. 4. Commit and enforce a lockfile containing package integrity metadata. 5. Prefer a trusted package registry with provenance information and protected publisher accounts. 6. Review transitive dependencies and package lifecycle scripts before installation. 7. In CI, use a restricted, non-privileged runner without production credentials and with minimal filesystem access. 8. Document the expected package name, exact version, source commit, and verification procedure. ]]>