T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:62
- Finding
- Unpinned Runtime Dependency Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 62-74 **Vulnerability Type**: Supply-chain risk from unpinned runtime package execution **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "clawnet": { "command": "npx", "args": ["tsx", "src/mcp/server.ts"], "env": { "CLAWNET_API_KEY": "your_key", "CLAWNET_BASE_URL": "https://api.claw-net.org" } } } } ``` ### Technical Analysis The documented MCP configuration launches `tsx` through `npx` without specifying an exact package version. If `tsx` is not already available locally, `npx` may retrieve and execute it from the configured npm registry at runtime. The project provides no dependency manifest, lockfile, integrity hash, or vendored reviewed copy that constrains the executed package. Consequently, the code ultimately executed by this configuration can differ from the code reviewed during the audit. A compromised registry account, malicious package release, unsafe registry configuration, or unexpected upstream update could introduce arbitrary code. The child process also receives `CLAWNET_API_KEY` through its environment. Any malicious code executed during package resolution or startup could read and disclose that credential. The referenced `src/mcp/server.ts` is absent from the audited project, so the MCP procedure is not self-contained and cannot be fully verified from the supplied artifact. ### Attack Path 1. A user copies the documented MCP configuration into a supported client. 2. The client starts the configured server by executing `npx tsx src/mcp/server.ts`. 3. The required package is unavailable locally, causing `npx` to resolve or download it from the configured npm registry. 4. An attacker-controlled or compromised package version is selected because no exact version or integrity constraint is present. 5. Package installation or startup code executes with the user's local privileges. 6. The malicious code reads i ...[truncated 629 chars]
- Remediation
- ## Remediation Suggestions 1. Add a dependency manifest and lockfile to the project, and pin `tsx` to a reviewed exact version. 2. Install dependencies explicitly during a controlled setup step rather than allowing `npx` to acquire packages when the MCP server starts. 3. Invoke the locked local binary, such as `node_modules/.bin/tsx`, with runtime package downloads disabled. 4. Enforce the official npm registry and use lockfile integrity metadata during installation. 5. Ship the referenced `src/mcp/server.ts` in the audited artifact so users can review the complete execution path. 6. Run the MCP server in a restricted environment with minimal filesystem and network permissions. 7. Provide the API key only to reviewed application code and avoid exposing unrelated secrets through the child process environment. 8. Add automated dependency scanning and verify package provenance before releases.