Robot/robot-js

Add integrity checks when downloading pre-compiled binaries

dkrutsko opened this issue · 0 comments

Currently, installing robot-js via NPM may be susceptible to man-in-the-middle attacks. This is due to the pre-compiled binaries being downloaded over HTTP instead of HTTPS. Unfortunately, because these binaries are hosted on GitHub, it's not easy to switch to HTTPS. A possible solution would be to perform a file integrity check after downloading the file to ensure that no tampering has taken place.

In the meantime, if security is a huge concern, download the binaries directly from GitHub or compile them manually using the guide available here.