T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:50
- Finding
- Unpinned Third-Party npm Package Is Downloaded and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 50–59; repeated at lines 71–72, 81, 90–91, 103–104, and 118–119 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown Add the following to the agent's MCP configuration. No manual installation is needed — `npx` downloads and runs `aipex-mcp-bridge` automatically. ### Cursor (`.cursor/mcp.json`) ```json { "mcpServers": { "aipex-browser": { "command": "npx", "args": ["-y", "aipex-mcp-bridge"] } } } ``` ``` Equivalent unpinned execution is also prescribed for Claude Desktop, Claude Code, VS Code Copilot, Windsurf, and the custom-port configuration. ### Technical Analysis The recommended configuration invokes: ```bash npx -y aipex-mcp-bridge ``` No exact package version, integrity hash, lockfile, or verified artifact is specified. Consequently, `npx` can retrieve and execute whichever package release the npm registry resolves at runtime. The `-y` option suppresses the normal installation confirmation, reducing the opportunity for users to inspect the resolved package and version. This creates a supply-chain trust boundary in which the effective executable can change after the Skill itself has been reviewed. If the npm publisher account, package release process, registry response, or another relevant distribution component is compromised, malicious code could execute under the local account that launches the MCP server. The configuration is intended to remain in an MCP client configuration, so the exposure can recur whenever the MCP server is launched. The audit did not find evidence that the currently referenced package is malicious; the vulnerability is the unsafe, unpinned execution model. ### Attack Path 1. An attacker compromises the npm publisher account, release pipeline, or another component capable of altering the package version resolved for `aipex-mcp-bridge`. 2. The attacker publishes a malicio ...[truncated 1387 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the package to an exact, reviewed version in every configuration: ```json { "command": "npx", "args": ["-y", "aipex-mcp-bridge@1.2.3"] } ``` Replace the example version with a release that has been independently audited. 2. Prefer installing through a lockfile-controlled project using `npm ci`, rather than resolving the package dynamically whenever the MCP server starts. 3. Verify package provenance and integrity through npm provenance attestations, trusted publisher documentation, and recorded artifact hashes where the deployment mechanism supports them. 4. Remove `-y` when interactive confirmation is practical so users can inspect the package name and resolved version before first execution. 5. Use a locally installed, reviewed executable in the MCP configuration instead of allowing `npx` to fetch code at launch time. 6. Run the bridge under a dedicated, least-privileged account or sandbox. Restrict filesystem access, environment variables, network destinations, and browser-extension permissions to those required for browser automation. 7. Establish a controlled upgrade process in which new versions are reviewed, tested, and explicitly approved before changing the pinned version. 8. Apply the corrected configuration consistently to all examples in `SKILL.md`, including Cursor, Claude Desktop, Claude Code, VS Code Copilot, Windsurf, and custom-port variants. ]]>