T08 · Insecure Dependencies
Warning
- Location
- README.md:43
- Finding
- Unpinned Third-Party Package Installation and Execution## Vulnerability Details **File Location**: `README.md:43-45` and `README.md:62-64` **Vulnerability Type**: Unpinned and immediately executed third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Install the MeshCore CLI npm install -g @meshcore/cli ``` ```bash npx @meshcore/mcp-server ``` ### Technical Analysis The documentation instructs users to install or execute npm packages without specifying reviewed versions or verifying package integrity. Both commands consequently resolve mutable package versions from the npm registry. The `npx @meshcore/mcp-server` command is particularly sensitive because it can download and immediately execute the package's lifecycle scripts and application code. The global installation of `@meshcore/cli` can likewise execute installation scripts and exposes the system to all code contained in the currently published package version. This is a supply-chain risk: the code ultimately executed can change after the skill has been audited. Compromise of the package, maintainer account, publishing credentials, package registry, or dependency tree could introduce malicious code without requiring any modification to this repository. ### Attack Path 1. An attacker compromises a package maintainer, npm publishing credentials, the package itself, or one of its transitive dependencies. 2. The attacker publishes a malicious release under the same package name. 3. A user follows the documented command without selecting a previously reviewed version. 4. npm resolves and downloads the malicious release. 5. Package installation scripts or runtime code execute with the privileges of the user running npm. 6. The malicious package can access files, environment variables, network resources, and credentials available to that user. ### Impact Assessment Successful exploitation permits arbitrary code execution with the privileges of the user who invokes npm. Potential conseq ...[truncated 429 chars]
- Remediation
- ## Remediation Suggestions - Pin every documented package to an explicitly reviewed version, for example: ```bash npm install --save-dev @meshcore/cli@REVIEWED_VERSION npx --yes @meshcore/mcp-server@REVIEWED_VERSION ``` - Prefer project-local dependencies governed by a committed lockfile instead of global installations. - Use `npm ci` with a reviewed lockfile in automated or reproducible environments. - Verify package provenance, publisher identity, signatures where available, and registry integrity before installation. - Review package lifecycle scripts and transitive dependencies before recommending execution. - Run marketplace tooling in a sandbox or container with minimal filesystem access, network access, and environment credentials. - Avoid running npm or `npx` as an administrator or root user.