T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned Third-Party Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 17–20 **Vulnerability Type**: Supply-chain exposure through an unpinned npm package **Risk Level**: Medium **Complete Code Snippet**: ```markdown ## MCP Server ```bash npx @indigoprotocol/indigo-mcp ``` ``` ### Technical Analysis The documented prerequisite instructs users to execute the third-party npm package `@indigoprotocol/indigo-mcp` through `npx` without specifying an exact version or verifying package integrity. Depending on the local npm configuration and cache, `npx` can retrieve the currently resolved package release from the npm registry and execute its lifecycle or runtime code with the invoking user's privileges. The reviewed project does not include the MCP server's source code, a package lockfile, an integrity hash, or another mechanism that binds execution to an audited artifact. Consequently, the effective implementation can change after this skill has been reviewed. This is a supply-chain weakness rather than evidence that the currently published package is malicious. ### Attack Path 1. An attacker compromises the package maintainer account, registry publication process, package release, or one of its transitive dependencies. 2. The attacker publishes a modified version that contains malicious lifecycle or runtime behavior. 3. A user follows the prerequisite and runs `npx @indigoprotocol/indigo-mcp`. 4. `npx` resolves and downloads the mutable package version from the registry. 5. The malicious code executes under the user's operating-system account. 6. It can access resources available to that account or manipulate the unsigned financial transactions returned by the MCP server. 7. If transaction manipulation is not noticed during wallet review, the user may sign and submit a transaction with attacker-selected or otherwise unsafe effects. ### Impact Assessment Successful exploitation could grant arbitrary code execution with th ...[truncated 805 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the MCP server to an audited exact version, for example: ```bash npx --yes @indigoprotocol/indigo-mcp@<exact-audited-version> ``` 2. Prefer installation through a committed lockfile that records exact transitive dependency versions and integrity metadata. 3. Verify the downloaded package against an independently published checksum, signed release, or trusted provenance attestation. 4. Document the expected npm registry and package source to reduce dependency-confusion and registry-substitution risks. 5. Run the MCP server with least privilege in an isolated environment that has no unnecessary secrets, wallet keys, or filesystem access. 6. Require wallet-side transaction review before signing, including network, inputs, recipients, change outputs, assets, amounts, fees, minting or burning actions, and script interactions. 7. Establish a controlled upgrade and re-audit process rather than automatically consuming newly published package versions.