T08 · Insecure Dependencies
Error
- Location
- SKILL.md:51
- Finding
- Automatic Execution of an Unpinned npm Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 51–53 **Vulnerability Type**: Unpinned and automatically executed third-party dependency **Risk Level**: High ```json "command": "npx", "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/geo/mcp"] } ``` ### Technical Analysis The MCP configuration invokes `npx` with the `-y` option to download and execute `mcp-remote@latest` automatically. The `latest` tag is mutable, so the package code executed at installation time can differ from the version available when the skill was reviewed. Because `npx` executes the downloaded package locally, a compromised npm package, maintainer account, publishing pipeline, or future malicious release could result in arbitrary code execution. The `-y` option removes the interactive confirmation that might otherwise alert the user to package installation. This is an insecure supply-chain configuration because neither an exact package version nor an integrity digest is specified. The effective executable payload is therefore outside the reviewed project and can change without any modification to `SKILL.md`. ### Attack Path 1. An attacker compromises the `mcp-remote` npm package, its maintainer account, or its release pipeline. 2. The attacker publishes a malicious release and assigns it to the `latest` distribution tag. 3. A user enables the documented MCP configuration. 4. `npx -y` retrieves the attacker-controlled package without requesting confirmation. 5. The package executes locally with the privileges of the user or agent process. 6. The malicious package can access data and perform operations available to that process. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the permissions of the account running the MCP server. Depending on the execution environment, this may expose readable files, environment variables, agent-accessible credentials, network resources, ...[truncated 417 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `mcp-remote@latest` with an exact, reviewed version such as `mcp-remote@x.y.z`. 2. Install the dependency through a committed package manifest and lockfile that records the resolved package and integrity hash. 3. Remove `-y` where interactive installation is appropriate so unexpected downloads require explicit approval. 4. Configure npm to use a trusted registry and enforce lockfile integrity during installation. 5. Review the selected package version and its transitive dependencies before deployment. 6. Run the MCP process in a sandbox or container with minimal filesystem, credential, and network access. 7. Use automated dependency monitoring, but require review and testing before updating the pinned version. 8. Where practical, install an internally mirrored and verified package artifact rather than retrieving executable code dynamically at startup.