T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned Third-Party npm Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 14–18 **Vulnerability Type**: Unpinned and automatically executed third-party dependency **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "supercolony": { "command": "npx", "args": ["-y", "supercolony-mcp"] } } } ``` ### Technical Analysis The configuration invokes `npx -y supercolony-mcp` without specifying an exact package version or integrity hash. When the package is unavailable locally, `npx` resolves it through the configured npm registry, downloads it, and executes it. The `-y` option suppresses the normal confirmation prompt. Because neither the version nor package integrity is pinned, the effective executable can change after the Skill has been reviewed. Package-maintainer compromise, a malicious future release, dependency-chain compromise, registry substitution, or an attacker-controlled local npm registry configuration could cause malicious code to be retrieved and run. ### Attack Path 1. An attacker compromises the `supercolony-mcp` package, one of its transitive dependencies, its publishing credentials, or the registry used by the target. 2. The attacker publishes or serves a malicious package version under the package name expected by the configuration. 3. A user or agent loads the documented MCP server configuration. 4. `npx -y` resolves and downloads the currently available package without requesting confirmation. 5. The downloaded package executes with the operating-system permissions and environment of the invoking process. 6. Malicious package code can access resources available to that process or expose attacker-controlled MCP tools and responses to the agent. ### Impact Assessment Successful exploitation permits arbitrary code execution with the privileges of the user running the MCP server. Depending on that user's environment and permissions, the package could read accessible files, environment va ...[truncated 439 chars]
- Remediation
- ## Remediation Suggestions - Pin `supercolony-mcp` to a reviewed, exact version rather than resolving the latest available release. - Verify the package's provenance and document its official registry and source repository. - Use lockfile and registry integrity metadata or an equivalent cryptographic verification mechanism. - Prefer installing a reviewed dependency locally through a controlled deployment process, then execute that verified local binary instead of downloading code automatically at runtime. - Remove `-y` where practical so installation requires explicit approval. - Restrict npm to an approved registry and protect against user-level or environment-level registry substitution. - Run the MCP server with least privilege in a sandbox or container, exposing only the files, environment variables, credentials, and network destinations required for its documented operation. - Establish an update-review process so new package versions and transitive dependency changes are audited before deployment.