T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:24
- Finding
- Unpinned Third-Party Package Execution with Bootstrap Credential Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24-27 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown 3. Copy the generated bootstrap one-liner. 4. Run: `npx hipokamp-mcp setup --bootstrap-token <token> --gateway <gateway-origin>` 5. Let `hipokamp-mcp` write local config under `~/.hipokamp/config.json`. ``` ### Technical Analysis The documented command invokes `hipokamp-mcp` through `npx` without pinning an exact package version or requiring integrity or signature verification. Depending on the local npm configuration and cache, `npx` may retrieve the package from a remote registry and immediately execute its installation or runtime code with the invoking user's privileges. The package receives a sensitive bootstrap token through a command-line argument and is expected to write configuration beneath the user's home directory. Consequently, a compromised, replaced, or incorrectly identified npm package would have both local code-execution capability and direct access to an authentication credential. The package name `hipokamp-mcp` also differs in spelling from the “Hippocampus” product name used throughout the document. The available project material does not establish that this name is malicious or incorrect, but the discrepancy increases package-identity and typo-squatting uncertainty. No malicious behavior in the package itself can be confirmed because its source is not included in the audited project. ### Attack Path 1. An attacker compromises the npm account or release process for `hipokamp-mcp`, or publishes a confusingly named package that users resolve instead of the intended package. 2. The user follows the onboarding instructions and runs the unpinned `npx hipokamp-mcp` command. 3. `npx` retrieves the mutable package version currently selected by the configured registry. 4. npm executes package-controlled installation or runtime code with the permissions of th ...[truncated 951 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Confirm and document the canonical npm package name, preferably using a verified organizational scope such as `@vendor/package`. 2. Pin the command to a reviewed, immutable version rather than allowing automatic resolution to the latest release. 3. Publish the official registry and source repository URLs so users can verify package provenance. 4. Verify package integrity or signatures before execution and document the expected digest where operationally practical. 5. Prefer a lockfile-based installation workflow in which dependency versions and integrity hashes are committed and reviewed. 6. Avoid placing bootstrap credentials directly in command-line arguments because they may be exposed through shell history or process inspection. Accept the token through protected standard input, an interactive prompt, or a permission-restricted temporary credential file. 7. Ensure bootstrap tokens are narrowly scoped, short-lived, single-use, and immediately revocable. 8. Document the precise files and configuration changes the setup utility performs, and recommend execution from a minimally privileged user account or isolated environment. ]]>