T08 · Insecure Dependencies
Warning
- Location
- mcp-server.example.json:3
- Finding
- Unpinned npm Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `mcp-server.example.json:3-4`; duplicated in `SKILL.md:30-31` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code `mcp-server.example.json:3-4`: ```json "command": "npx", "args": ["-y", "settld-mcp"], ``` `SKILL.md:30-31`: ```text - command: `npx` - args: `["-y","settld-mcp"]` ``` ### Technical Analysis The MCP server configuration invokes `npx -y settld-mcp` without specifying an exact package version or verifying package integrity. If the package is not already available locally, `npx` can retrieve it from the configured npm registry and execute it immediately. The `-y` option suppresses the installation confirmation prompt. This design causes the code executed by the Skill to depend on whichever package version the registry resolves at runtime rather than a version reviewed alongside this project. A compromised publisher account, malicious package release, registry compromise, or unexpected upstream update could therefore introduce arbitrary executable code after the Skill itself has been audited. The spawned package receives the configured environment, including `SETTLD_API_KEY`, `SETTLD_TENANT_ID`, and service endpoint values. The repository provides no evidence that `settld-mcp` is currently malicious; the risk arises from automatic execution of an unpinned and externally supplied dependency. ### Attack Path 1. An attacker compromises the `settld-mcp` publishing account or otherwise causes a malicious version to be resolved by the npm registry. 2. A user registers or starts the documented MCP server configuration. 3. `npx -y settld-mcp` downloads the currently resolved package without interactive confirmation or an exact version constraint. 4. The downloaded package executes with the privileges of the process running the agent. 5. The malicious package reads environment variables supplied to the MCP ...[truncated 992 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the floating package reference with an exact, reviewed version, such as `settld-mcp@X.Y.Z`; do not use version ranges. 2. Install the dependency during a controlled build or deployment phase rather than downloading it when the MCP server starts. 3. Commit and enforce an npm lockfile containing integrity hashes, and use `npm ci` against an approved registry. 4. Verify package provenance, signatures, checksums, publisher identity, and release contents before upgrades. 5. Remove `-y` from ad hoc runtime installation workflows so unexpected package retrieval cannot proceed silently. 6. Run the MCP server in a sandbox or container with a non-privileged account, restricted filesystem access, and narrowly allowlisted network destinations. 7. Supply a narrowly scoped, short-lived, and revocable Settld API key. Avoid granting settlement or payment permissions not required by the intended tools. 8. Establish dependency monitoring and an explicit review process for every package-version update.