T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:84
- Finding
- Unpinned npm Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md:84-106` **Additional Location**: `README.md:16-56` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```json { "plugins": { "entries": { "web3-daily-mcp": { "enabled": true, "command": "npx", "args": ["web3-daily-mcp"] } } } } ``` The same unpinned command is also recommended for Claude Desktop, OpenClaw, and Cursor: ```json { "mcpServers": { "web3-daily": { "command": "npx", "args": ["web3-daily-mcp"] } } } ``` ### Technical Analysis The documented configurations invoke `npx web3-daily-mcp` without an exact package version. Depending on the local npm cache and installation state, `npx` can retrieve the package version currently selected by the npm registry. The code executed later may therefore differ from the version audited here. Although the repository contains a lockfile with integrity hashes for its dependencies, that lockfile does not pin the top-level package selected by these external `npx` configurations. A compromised publisher account, malicious future release, or registry-level package compromise could replace the effective MCP executable without requiring any change to this repository. No evidence indicates that the package or its current dependencies are malicious. The risk arises from the unsafe installation and execution pattern. ### Attack Path 1. An attacker compromises the npm publishing account, release pipeline, or package distribution channel for `web3-daily-mcp`. 2. The attacker publishes a malicious version under the same package name. 3. A user installs or starts the MCP server using the documented unversioned `npx web3-daily-mcp` configuration. 4. `npx` resolves and downloads the attacker-controlled release. 5. Node.js executes the malicious package as the user running the MCP host. 6. The payload can access resources available to that user and ...[truncated 639 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the package to a reviewed exact version in every configuration: ```json { "command": "npx", "args": ["--yes", "web3-daily-mcp@1.0.0"] } ``` 2. Avoid version ranges, tags such as `latest`, and unversioned package names in executable MCP configurations. 3. Prefer installing from a trusted lockfile and invoking the locally installed executable rather than downloading code during MCP startup: ```bash npm ci npm run build node dist/index.js ``` 4. Verify npm package provenance, publisher identity, integrity metadata, and release signatures before updating the pinned version. 5. Review dependency and lockfile changes for every release. Use automated dependency scanning and require approval for package updates. 6. Run the MCP server under a dedicated, least-privileged account or sandbox with restricted filesystem, environment-variable, and network access. 7. Update all affected examples in `SKILL.md` and `README.md` so users are not directed toward unpinned execution.