[repo-health] Medium: Dockerfile fetches and executes remote shell scripts via curl | bash — supply-chain risk

[Liohtml]

Finding

Severity: Medium
Confidence: High
File: assets/Dockerfile (lines 31, 53)

Description

The Dockerfile installs Node.js and Rust by piping remote shell scripts directly to bash/sh at image build time — a pattern that trusts the remote server to serve benign content on every build:

# Line 31 — NodeSource bootstrap
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash -

# Line 53 — rustup installer
RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs \
        | sh -s -- -y --no-modify-path --profile minimal

If either remote host (deb.nodesource.com or sh.rustup.rs) is compromised, a CDN is hijacked, or a DNS attack succeeds at build time, the fetched script runs with root privileges inside the build container and can inject arbitrary code into every image built thereafter — including poisoning the globally installed Claude Code and tsx packages.

This is distinct from the unpinned @anthropic-ai/claude-code issue (#9): that issue concerns npm version drift; this issue concerns unauthenticated remote code execution at the OS bootstrapping layer, which has a higher blast radius.

Recommendation

• Node.js: use a pinned official Docker base image instead of the NodeSource install script, e.g. FROM node:22-slim then layer Python/Rust on top. This removes the curl | bash step entirely.
• Rust: pin the rustup version and verify its checksum, or switch to an official rust:slim layer for the Rust build stage. At minimum add --hash <sha256> to the curl invocation and verify before executing.
• Short-term: add --no-cache guardrails in CI and consider a Dockerfile linter (e.g. hadolint) that flags curl | bash patterns.

---

Filed by automated repo-health audit on 2026-06-17