T08 · Insecure Dependencies
- Location
SKILL.md:99- Finding
Unpinned npm Packages Are Downloaded and Executed Without Confirmation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 99–103; repeated at lines 380–384. Related package invocation instructions also appear at lines 59 and 65.
Vulnerability Type: Supply-chain risk from mutable, unpinned npm dependencies
Risk Level: MediumComplete vulnerable configuration:
json { "mcpServers": { "12306-mcp": { "command": "npx", "args": ["-y", "12306-mcp"] }, "amap-mcp": { "type": "sse", "url": "https://mcp.amap.com/sse?key={AMAP_WEB_KEY}" } } }The same unsafe execution pattern is documented for an optional package:
text npx -y xhs-mcpTechnical Analysis
The configuration invokes
npxwith the-yoption and a package name that has no exact version or integrity constraint. If the package is not already available in a trusted local cache,npxcan retrieve it from the configured npm registry and execute it without an interactive confirmation prompt.Because
12306-mcpandxhs-mcpare not pinned to reviewed versions, the effective code can change after this Skill has been audited. A compromised maintainer account, malicious future release, registry compromise, dependency confusion condition, or compromise of a transitive dependency could therefore turn an otherwise legitimate MCP startup operation into arbitrary local code execution.This finding establishes an unsafe dependency-execution mechanism; it does not establish that the currently published packages are malicious.
Attack Path
- An attacker compromises the relevant npm package, its maintainer account, the package publication process, or a transitive dependency.
- The attacker publishes a malicious version that becomes the version resolved by the unpinned package name.
- A user or Agent applies the MCP configuration or runs the documented
npx -ycommand. npxresolves and downloads the mutable package version without as ...[truncated 878 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin every npm dependency to a reviewed exact version, for example
12306-mcp@X.Y.Z, rather than resolving a mutable latest release. - Use a lockfile with verified registry integrity hashes and retain it as part of the reviewed deployment artifact.
- Install dependencies during a controlled build or provisioning phase instead of downloading and executing packages at Skill invocation time.
- Use an approved private registry or package allowlist and verify package provenance, publisher identity, signatures, and checksums.
- Review direct and transitive dependencies before upgrades, and automate vulnerability and unexpected-maintainer-change monitoring.
- Disable npm lifecycle scripts where operationally possible, such as with
--ignore-scripts, while confirming that the selected package does not legitimately require them. - Run MCP servers in a restricted sandbox or container with minimal filesystem access, no unnecessary credentials, limited environment variables, a non-privileged user, and outbound-network controls.
- Replace
-ywith an explicit installation and approval workflow so dependency changes cannot be accepted silently.
- Pin every npm dependency to a reviewed exact version, for example