T08 · Insecure Dependencies
Warning
- Location
SKILL.md:42- Finding
Automatic Execution of an Unpinned npm Dependency
- Content
View full analysis
' --all-parameters # Get the schema of the specified tool npx -y mcporter list 'open.larksuite.com/mcp/stream/' --json | jq '.tools[] | select(.name == "")' ``` ```shell npx -y mcporter call 'open.larksuite.com/mcp/stream/.' param1:"value1" foo:"bar" ``` ```text To improve compatibility, use `npx -y mcporter` instead of `mcporter` when executing commands. ``` ### Technical Analysis The Skill explicitly instructs the Agent to execute `mcporter` through `npx -y` without specifying an exact package version or verifying package integrity. If the package is not already available locally, `npx` can retrieve the currently resolved release from the configured npm registry and immediately execute it. The `-y` option suppresses the interactive installation prompt. Consequently, the code reviewed during this audit is not necessarily the code executed later. A compromised npm account, registry response, dependency, or future package release could introduce arbitrary executable behavior after the Skill has been approved. The package executes with the permissions of the Agent process. It may also be able to observe the workspace, process environment, network configuration, and token-bearing MCP URL supplied as a command-line argument. ### Attack Path 1. An attacker compromises the `mcporter` package, one of its dependencies, its publisher account, or the package source used by the configured npm registry. 2. The Agent follows the Skill instruction and runs `npx -y mcporter` without an exact version. 3. `npx` resolves, downloads, and executes the attacker-controlled release without requesting confirmation. 4. The malicious package runs with the Agent's local permissions. 5. It read ...[truncated 997 chars]- Remediation
View remediation
... ``` 2. Prefer declaring the dependency in a project manifest and committing a lockfile with integrity metadata. 3. Install dependencies during a controlled setup phase, then invoke the verified local binary instead of downloading code during normal Skill execution: ```shell ./node_modules/.bin/mcporter ... ``` 4. Use a trusted registry and enforce package integrity or provenance verification where supported. 5. Review the package and its transitive dependencies before updating the pinned version. 6. Execute the tool in a restricted environment with minimal filesystem, environment-variable, and network access. 7. Avoid exposing credential-bearing URLs in command-line arguments where feasible because process listings and diagnostic tooling may record them. ]]>