T08 · Insecure Dependencies
Warning
- Location
- references/clawhub-cli.md:7
- Finding
- Unpinned Global npm Package Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `references/clawhub-cli.md:7` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash npm i -g clawhub ``` ### Technical Analysis The documented command installs the `clawhub` npm package globally without specifying a reviewed version or package integrity value. Consequently, npm resolves the package version available under the configured registry and distribution tag at installation time. npm packages and their transitive dependencies may execute lifecycle scripts during installation. If the package, its publishing account, a transitive dependency, or the user's configured npm registry is compromised, following this instruction could execute attacker-controlled code. Global installation expands the potential effect by modifying the user's global Node.js environment. The project does not provide a lockfile, integrity hash, expected publisher information, or a pinned package version for this installation command. ### Attack Path 1. An attacker compromises the `clawhub` npm package, its publisher account, a transitive dependency, or a registry used by the victim. 2. The attacker publishes or serves a malicious version containing an installation lifecycle script or modified executable. 3. A user follows the documented `npm i -g clawhub` instruction. 4. npm resolves and downloads the attacker-controlled version because no version or integrity constraint is specified. 5. Malicious lifecycle code executes with the privileges of the user running npm. 6. The installed global executable may continue to run attacker-controlled behavior when subsequent `clawhub` commands are invoked. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the invoking user. This may expose files, environment variables, developer credentials, npm configuration, and other resources accessible ...[truncated 334 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version, for example: ```bash npm install --global clawhub@<reviewed-version> ``` 2. Document the expected npm registry, package publisher, and approved version so users can verify provenance before installation. 3. Review the resolved package and its transitive dependencies, including npm lifecycle scripts, before recommending an upgrade. 4. Prefer a project-local dependency with a committed lockfile where the deployment model permits it. 5. Use npm integrity and provenance verification mechanisms and avoid installation from untrusted registry mirrors. 6. Do not recommend running the installation command with `sudo` or from an administrator shell. 7. Establish a controlled update process that reviews new package versions before changing the documented pin.