T08 · Insecure Dependencies
- Location
SKILL.md:10- Finding
Mutable npm Dependency Is Downloaded and Executed Through npx
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:10
Vulnerability Type:T08: Insecure Dependencies
Risk Level: SuspiciousVulnerable Code
text No installation needed — uses `npx weixin-mcp@^1.7` directly (version pinned for security).Technical Analysis
The Skill directs the Agent to download and immediately execute the external
weixin-mcpnpm package throughnpx. The version constraint^1.7is not an immutable security pin: it can resolve to later compatible releases in the1.xseries. Consequently, the code executed at runtime can differ from the code that existed when this Skill was reviewed.The external package source is not included in the audited project, so its runtime implementation could not be verified. The documented commands grant that package access to sensitive operations and data, including WeChat login credentials, contacts, message content, local attachments, webhook payloads, and a long-running daemon. Network communication is necessary for the declared WeChat integration, but dynamically executing an unreviewed package version exceeds the minimum supply-chain assurance required for handling such sensitive data.
No evidence was found that the Skill intentionally selects a malicious package, uses a typosquatted name, or sends information to a concealed attacker-controlled endpoint. The risk arises from mutable third-party code and immediate execution rather than confirmed malicious behavior.
Attack Path
- An attacker compromises the npm publisher account, package repository, build pipeline, or another component used to publish
weixin-mcp. - The attacker publishes a malicious package release that satisfies the
^1.7version range. - A user or Agent follows the Skill instructions and invokes a command such as
npx weixin-mcp@^1.7 login,send,poll, orstart. npxresolves, downloads, and executes the compromised release without requiring that it ma ...[truncated 1226 chars]
- An attacker compromises the npm publisher account, package repository, build pipeline, or another component used to publish
- Remediation
View remediation
Remediation Suggestions
- Replace
weixin-mcp@^1.7with an exact, reviewed release such asweixin-mcp@1.7.x, using the specific patch version approved by the maintainer. - Use a lockfile and verify the package integrity hash so installation fails if the resolved artifact changes unexpectedly.
- Prefer a controlled installation process over repeated runtime downloads through
npx. Vendor the reviewed source or install it from a trusted internal registry where feasible. - Audit the resolved package and all transitive dependencies before deployment, and repeat the review before upgrading.
- Run the CLI under a dedicated, unprivileged account with filesystem access limited to the required WeChat data and explicitly selected attachments.
- Restrict outbound network access to endpoints required for WeChat operation. Keep webhook destinations on localhost or a trusted internal network unless the user explicitly approves an external recipient.
- Protect credential files with restrictive permissions and ensure daemon logs do not expose login tokens, context tokens, or private message content.
- Update the documentation to avoid describing a caret range as “pinned for security” and clearly disclose that
npxmay retrieve and execute external code.
- Replace