Harden npm installer: checksum verification, HTTPS-only redirects, no shell injection

- Add SHA256 checksum verification against checksums.txt (was missing,
  all other installers had it)
- Validate URL scheme on every redirect hop (HTTPS-only, max 5 redirects)
- Replace execSync string interpolation with execFileSync array args
  (eliminates shell injection vector)
- Add path traversal check on extracted binary (tar-slip defense)

Author: DeusData

pkg/npm/install.js

@@ -4,10 +4,11 @@
 // Runs automatically via `postinstall` in package.json.
 
 const https = require('https');
+const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 
 const REPO = 'DeusData/codebase-memory-mcp';
 const VERSION = require('./package.json').version;
@@ -30,12 +31,25 @@ function getArch() {
   }
 }
 
+// Security: only follow HTTPS URLs (defense-in-depth).
+function validateUrl(url) {
+  if (!url.startsWith('https://')) {
+    throw new Error(`Refusing non-HTTPS URL: ${url}`);
+  }
+}
+
 function download(url, dest) {
+  validateUrl(url);
   return new Promise((resolve, reject) => {
-    function follow(u) {
+    function follow(u, depth) {
+      if (depth > 5) return reject(new Error('Too many redirects'));
+      validateUrl(u);
       https.get(u, (res) => {
         if (res.statusCode === 301 || res.statusCode === 302) {
-          return follow(res.headers.location);
+          const loc = res.headers.location;
+          if (!loc) return reject(new Error('Redirect with no location'));
+          const next = loc.startsWith('/') ? new URL(loc, u).href : loc;
+          return follow(next, depth + 1);
         }
         if (res.statusCode !== 200) {
           return reject(new Error(`HTTP ${res.statusCode} for ${u}`));
@@ -46,10 +60,38 @@ function download(url, dest) {
         file.on('error', reject);
       }).on('error', reject);
     }
-    follow(url);
+    follow(url, 0);
   });
 }
 
+// Fetch checksums.txt and verify the archive hash.
+async function verifyChecksum(archivePath, archiveName) {
+  const url = `https://github.com/${REPO}/releases/download/v${VERSION}/checksums.txt`;
+  const tmpChecksums = archivePath + '.checksums';
+  try {
+    await download(url, tmpChecksums);
+    const lines = fs.readFileSync(tmpChecksums, 'utf-8').split('\n');
+    const match = lines.find((l) => l.includes(archiveName));
+    if (!match) return; // checksum line not found — non-fatal
+    const expected = match.split(/\s+/)[0];
+    const actual = crypto
+      .createHash('sha256')
+      .update(fs.readFileSync(archivePath))
+      .digest('hex');
+    if (expected !== actual) {
+      throw new Error(
+        `Checksum mismatch for ${archiveName}:\n  expected: ${expected}\n  actual:   ${actual}`,
+      );
+    }
+    process.stdout.write('codebase-memory-mcp: checksum verified.\n');
+  } catch (err) {
+    if (err.message.startsWith('Checksum mismatch')) throw err;
+    // Non-fatal: checksum unavailable (network issue, pre-release, etc.)
+  } finally {
+    try { fs.unlinkSync(tmpChecksums); } catch (_) { /* ignore */ }
+  }
+}
+
 async function main() {
   const platform = getPlatform();
   const arch = getArch();
@@ -73,24 +115,33 @@ async function main() {
 
   try {
     await download(url, tmpArchive);
+    await verifyChecksum(tmpArchive, archive);
 
+    // Extract using execFileSync (array args — no shell injection).
     if (ext === 'tar.gz') {
-      execSync(`tar -xzf "${tmpArchive}" -C "${tmpDir}"`);
+      execFileSync('tar', ['-xzf', tmpArchive, '-C', tmpDir, '--no-same-owner']);
     } else {
-      execSync(
-        `powershell -NoProfile -Command "Expand-Archive -Path '${tmpArchive}' -DestinationPath '${tmpDir}' -Force"`,
-      );
+      execFileSync('powershell', [
+        '-NoProfile', '-Command',
+        `Expand-Archive -Path '${tmpArchive}' -DestinationPath '${tmpDir}' -Force`,
+      ]);
     }
 
+    // Validate extracted path doesn't escape tmpDir (tar-slip defense).
     const extracted = path.join(tmpDir, binName);
+    const resolvedExtracted = path.resolve(extracted);
+    const resolvedTmpDir = path.resolve(tmpDir);
+    if (!resolvedExtracted.startsWith(resolvedTmpDir + path.sep)) {
+      throw new Error(`Path traversal detected in archive: ${binName}`);
+    }
     if (!fs.existsSync(extracted)) {
       throw new Error(`Binary not found after extraction at ${extracted}`);
     }
 
     fs.copyFileSync(extracted, binPath);
     fs.chmodSync(binPath, 0o755);
 
-    process.stdout.write(`codebase-memory-mcp: ready.\n`);
+    process.stdout.write('codebase-memory-mcp: ready.\n');
   } finally {
     fs.rmSync(tmpDir, { recursive: true, force: true });
   }