T08 · Insecure Dependencies
- Location
scripts/install.js:205- Finding
Execution of an Unpinned Remote npm Package
- Content
View full analysis
Vulnerability Details
File Location:
scripts/install.js:205-209
Additional References:SKILL.md:46,docs/WEIXIN-GUIDE.md:37,docs/WEIXIN-GUIDE.md:79
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: MediumVulnerable Code
javascript // Attempt the official installation command const installCommands = [ 'npx -y @tencent-weixin/openclaw-weixin-cli@latest install', 'openclaw plugins install "@tencent-weixin/openclaw-weixin"' ];The same unsafe command is also presented to users in the primary Skill instructions and integration guide:
bash npx -y @tencent-weixin/openclaw-weixin-cli@latest installTechnical Analysis
The installer invokes
npxwith both-yand the mutable@latestversion tag. This causes npm to download and execute whichever package version is identified as latest at execution time, without interactive package-installation confirmation.Consequently, the effective executable payload can change after this Skill has been reviewed. The project does not pin an exact version, provide a lockfile for the executed CLI, validate a package checksum or signature, or verify npm provenance before execution. Package installation and lifecycle code runs with the privileges of the user launching the installer.
The package name appears intentional rather than an obvious typographical error, and the audit found no evidence that the currently referenced package is malicious. The vulnerability is the absence of controls against a compromised, transferred, or unexpectedly modified package release.
Attack Path
- An attacker compromises the npm publisher account, release pipeline, package registry entry, or another component capable of controlling the package version associated with
@latest. - The attacker publishes a malicious release or causes the malicious version to become the latest release.
- A user follows the document ...[truncated 1203 chars]
- An attacker compromises the npm publisher account, release pipeline, package registry entry, or another component capable of controlling the package version associated with
- Remediation
View remediation
Remediation Suggestions
-
Replace
@latestwith an exact, reviewed version:javascript const installCommands = [ 'npx --yes @tencent-weixin/openclaw-weixin-cli@1.2.3 install' ]; -
Do not treat version pinning alone as sufficient. Verify the package artifact against a documented integrity hash, trusted signature, or npm provenance before execution.
-
Prefer declaring the CLI in a controlled project manifest and committing a lockfile. Install with a reproducible command such as
npm ci, then invoke the locked local binary. -
Review and pin transitive dependencies. Where feasible, vendor the reviewed installer artifact or distribute it through a trusted, integrity-verified release process.
-
Remove automatic confirmation with
-yfor security-sensitive installation flows, or present the exact version, source, requested actions, and integrity information before obtaining explicit user approval. -
Apply the same pinned command consistently in
SKILL.md,docs/WEIXIN-GUIDE.md, fallback instructions, and installer output so users are not directed back to the mutable@latestrelease. -
Run the package with the least privileges required. Explicitly warn users not to launch the installer as root or from an elevated administrator shell.
-
Fail closed if artifact verification fails instead of falling back automatically to another unverified remote installation mechanism.
-