T08 · Insecure Dependencies
- Location
README.md:77- Finding
Unpinned Third-Party MCP Packages Execute with User Privileges and Credential Access
- Content
View full analysis
Vulnerability Details
File Location:
README.md, lines 77-94
Vulnerability Type: Unpinned and automatically executed third-party dependencies
Risk Level: MediumVulnerable Code
json { "mcpServers": { "tradingview-m": { "description": "TradingView crypto analysis", "command": "npx", "args": ["-y", "tradingview-m-mcp@latest"] }, "alpha-vantage": { "description": "Alpha Vantage stock data", "command": "npx", "args": ["-y", "alpha-vantage-mcp@latest"], "env": { "ALPHAVANTAGE_API_KEY": "$env:ALPHAVANTAGE_API_KEY" } }, "yahoo-finance": { "description": "Yahoo Finance market data", "command": "npx", "args": ["-y", "yahoo-finance-mcp@latest"] } } }Technical Analysis
The documented configuration executes three third-party npm packages through
npx. Each package uses the mutable@latesttag, while-ysuppresses the interactive installation confirmation. Consequently, the code executed on a future invocation can differ from the version originally reviewed.npm packages can execute package lifecycle scripts during installation and arbitrary JavaScript when launched. The project does not pin reviewed versions, provide a lockfile or integrity hashes, verify package provenance, or require execution inside a sandbox. A compromised package release, maintainer account, or package-resolution path could therefore introduce arbitrary code without any modification to this Skill.
The
alpha-vantage-mcpprocess is explicitly givenALPHAVANTAGE_API_KEY. Access to this key is functionally necessary for authenticated Alpha Vantage requests, but providing it to automatically retrieved, mutable code creates a supply-chain exposure. Because these processes are otherwise launched with the user's normal privileges, a malicious release may also access other files, environment data, and ...[truncated 1893 chars]- Remediation
View remediation
Remediation Suggestions
-
Replace every
@latestreference with an exact, reviewed package version:json "args": ["-y", "alpha-vantage-mcp@X.Y.Z"]Apply the same control to the TradingView and Yahoo Finance packages.
-
Record dependency versions in a lockfile and enforce integrity verification during installation. Where supported, validate package signatures, registry provenance attestations, and expected integrity hashes.
-
Remove automatic
-yacceptance from security-sensitive setup instructions, or install dependencies through a separate, reviewable provisioning step rather than downloading code whenever the MCP server starts. -
Verify and document the official package names, publishers, source repositories, expected network destinations, and release-review process. This reduces dependency-confusion, typosquatting, and publisher-compromise risks.
-
Run each MCP server in an isolated container or restricted operating-system account with:
- Read-only access to required files.
- No access to unrelated home-directory data.
- A minimal environment.
- Restricted outbound network access limited to the corresponding market-data provider.
- Resource and process limits.
-
Supply
ALPHAVANTAGE_API_KEYonly to the Alpha Vantage process. Do not expose the parent process's complete environment where a minimal allowlist can be used. -
Use a dedicated, least-privileged API key with provider-side quotas and restrictions where available. Establish key rotation and immediate revocation procedures for suspected package compromise.
-
Avoid running these commands as
root, throughsudo, or from an administrator shell. Document that MCP packages must run only with an unprivileged account. -
Add dependency monitoring and periodically review pinned updates before deployment rather than accepting new releases automatically.
-