T08 · Insecure Dependencies
- Location
scripts/openclaw-host-installer.mjs:585- Finding
Installer downloads and executes third-party packages without integrity verification
- Content
View full analysis
Vulnerability Details
File Location:
scripts/openclaw-host-installer.mjs:17-20, 585-613; related instructions inSKILL.md:24-29, 50, 136-142
Vulnerability Type: Supply-chain exposure through externally retrieved executable dependencies
Risk Level: HighVulnerable Code
js export const PINNED_PACKAGES = Object.freeze({ hiMcpServer: '@hirey-ai/mcp-server@0.1.22', hiAgentReceiver: '@hirey-ai/agent-receiver@0.1.12', });js async function installPinnedPackages(options, paths, snapshot) { const packageVersionsOk = snapshot.packageVersions.hiMcpServer === '0.1.22' && snapshot.packageVersions.hiAgentReceiver === '0.1.12' && snapshot.hiMcpBinaryExists && snapshot.hiReceiverBinaryExists; if (options.skipPackageInstall || packageVersionsOk) { return { changed: false, skipped: !!options.skipPackageInstall }; } const result = await execFileAsync('npm', [ 'install', '--prefix', paths.vendorDir, '--no-audit', '--no-fund', PINNED_PACKAGES.hiMcpServer, PINNED_PACKAGES.hiAgentReceiver, ], { encoding: 'utf8', maxBuffer: 8 * 1024 * 1024, }); return { changed: true, skipped: false, stdout: result.stdout || '', stderr: result.stderr || '', }; }The Skill also directs the agent to install a mutable ClawHub package:
text openclaw plugins install clawhub:hirey-aiTechnical Analysis
Setup downloads executable components from ClawHub and the npm registry. Although the npm package versions are exact, no lockfile, package integrity hash, signature, or trusted-publisher verification is included in the audited project. An exact version prevents ordinary version drift but does not protect against registry compromise, account takeover, republishing where supported, or a compromised package artifact.
Standard
npm installbehavior may exe ...[truncated 2085 chars]- Remediation
View remediation
Remediation Suggestions
- Pin the ClawHub package to an immutable version and preferably a verified content digest.
- Commit a lockfile containing npm integrity metadata and use a deterministic installation command such as
npm ci. - Verify package signatures or expected SHA-256 hashes before executing downloaded code.
- Use
--ignore-scriptsduring installation where package functionality permits it. If lifecycle scripts are essential, document and independently review each required script. - Avoid
--no-audit, or perform an equivalent vulnerability scan and fail installation for disallowed critical findings. - Review and pin transitive dependencies, not only the two top-level package versions.
- Keep the versions documented in
SKILL.md, installed by the script, and checked during validation identical. - Run retrieved components in a sandbox with narrowly scoped filesystem, network, environment-variable, and OpenClaw tool access.
- Record the verified artifact hashes and installed versions in the manifest to support subsequent integrity checks.