T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:38
- Finding
- Unpinned Third-Party Package Is Automatically Retrieved and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 38–52 **Vulnerability Type**: Unpinned dependency execution through `npx` **Risk Level**: Medium The documented stdio MCP configuration instructs clients to retrieve and execute a third-party npm package without specifying an exact version or integrity constraint: ```json { "mcpServers": { "nexdoc": { "command": "npx", "args": ["-y", "@nexdoc/mcp-server"], "env": { "NXD_API_KEY": "nxd_live_..." } } } } ``` ### Technical Analysis Running `npx -y @nexdoc/mcp-server` resolves the package version from the configured npm registry at execution time. Because no exact version is pinned, the code executed by the client can change after the skill has been reviewed. The `-y` option suppresses the normal installation confirmation, further reducing the opportunity for users to inspect the resolved package and version. This creates a supply-chain trust boundary in which compromise of the package, its publisher account, its dependencies, or the configured registry could cause attacker-controlled code to run locally. The package process also receives `NXD_API_KEY` through its environment, making that credential accessible to any code executed within the package process. The audit did not establish that the referenced package is currently malicious. The confirmed issue is the unsafe, unpinned retrieval and automatic execution pattern. ### Attack Path 1. An attacker compromises the npm package publisher, a transitive dependency, or the registry resolution path. 2. The attacker publishes or serves a malicious version under the expected package name. 3. A user follows the documented configuration and starts the MCP client. 4. `npx` resolves the package available at that time and, because `-y` is specified, executes it without an interactive confirmation. 5. The malicious package runs with the operating-system privile ...[truncated 925 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the package to a reviewed, exact version, for example: ```json "args": ["-y", "@nexdoc/mcp-server@1.2.3"] ``` Replace the example version with a version that has been independently verified. 2. Document the expected package publisher, registry, release version, and package provenance so users can verify that resolution has not been redirected. 3. Use a lockfile and integrity hashes where the MCP client installation workflow supports them. Prefer reproducible installation from a reviewed dependency tree over resolving packages dynamically at every launch. 4. Remove `-y` where practical so unexpected installation or version changes require explicit confirmation. 5. Review new package versions and their transitive dependency changes before updating the pinned version. Consider automated dependency scanning, provenance verification, and npm package signature or attestation checks. 6. Run the MCP server with least privilege in a restricted environment. Limit filesystem access, outbound network access, and inherited environment variables to those required for operation. 7. Scope and rotate `NXD_API_KEY`, avoid exposing unrelated credentials to the MCP process, and revoke the key promptly if dependency compromise is suspected.