T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:99
- Finding
- Unpinned npm Packages Are Downloaded and Executed Without Confirmation## Vulnerability Details **File Location**: `SKILL.md`, lines 99–103; repeated at lines 380–384. Related package invocation instructions also appear at lines 59 and 65. **Vulnerability Type**: Supply-chain risk from mutable, unpinned npm dependencies **Risk Level**: Medium **Complete vulnerable configuration:** ```json { "mcpServers": { "12306-mcp": { "command": "npx", "args": ["-y", "12306-mcp"] }, "amap-mcp": { "type": "sse", "url": "https://mcp.amap.com/sse?key={AMAP_WEB_KEY}" } } } ``` The same unsafe execution pattern is documented for an optional package: ```text npx -y xhs-mcp ``` ### Technical Analysis The configuration invokes `npx` with the `-y` option and a package name that has no exact version or integrity constraint. If the package is not already available in a trusted local cache, `npx` can retrieve it from the configured npm registry and execute it without an interactive confirmation prompt. Because `12306-mcp` and `xhs-mcp` are not pinned to reviewed versions, the effective code can change after this Skill has been audited. A compromised maintainer account, malicious future release, registry compromise, dependency confusion condition, or compromise of a transitive dependency could therefore turn an otherwise legitimate MCP startup operation into arbitrary local code execution. This finding establishes an unsafe dependency-execution mechanism; it does not establish that the currently published packages are malicious. ### Attack Path 1. An attacker compromises the relevant npm package, its maintainer account, the package publication process, or a transitive dependency. 2. The attacker publishes a malicious version that becomes the version resolved by the unpinned package name. 3. A user or Agent applies the MCP configuration or runs the documented `npx -y` command. 4. `npx` resolves and downloads the mutable package version without as ...[truncated 878 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every npm dependency to a reviewed exact version, for example `12306-mcp@X.Y.Z`, rather than resolving a mutable latest release. 2. Use a lockfile with verified registry integrity hashes and retain it as part of the reviewed deployment artifact. 3. Install dependencies during a controlled build or provisioning phase instead of downloading and executing packages at Skill invocation time. 4. Use an approved private registry or package allowlist and verify package provenance, publisher identity, signatures, and checksums. 5. Review direct and transitive dependencies before upgrades, and automate vulnerability and unexpected-maintainer-change monitoring. 6. Disable npm lifecycle scripts where operationally possible, such as with `--ignore-scripts`, while confirming that the selected package does not legitimately require them. 7. Run MCP servers in a restricted sandbox or container with minimal filesystem access, no unnecessary credentials, limited environment variables, a non-privileged user, and outbound-network controls. 8. Replace `-y` with an explicit installation and approval workflow so dependency changes cannot be accepted silently.