T08 · Insecure Dependencies
Warning
- Location
package.json:31- Finding
Unpinned Globally Installed Dependency Creates Supply-Chain Risk
- Content
View full analysis
=0.7.0" }, ``` `README.md:21-25`: ```markdown ### 2. Install Dependencies ```bash npm install -g mcporter ``` ``` ### Technical Analysis The dependency declaration accepts every `mcporter` release from version 0.7.0 onward, while the documented installation command installs the registry's current default release globally. The project provides no exact version pin, lockfile, package integrity value, or documented publisher verification procedure. `mcporter` is security-sensitive in this project because it receives the token-bearing DingTalk MCP endpoint and processes document identifiers and document contents. Installing it globally also causes its executable to be available system-wide under the user's account. This does not prove that the current `mcporter` package is malicious. The vulnerability is the absence of controls ensuring that users install the same reviewed artifact over time. A compromised publisher account, malicious future release, or registry-level package substitution could therefore introduce code that was not covered by this audit. ### Attack Path 1. An attacker compromises the package publisher, publishing process, or package registry entry for a future `mcporter` release. 2. The malicious release remains compatible with the permissive `>=0.7.0` declaration. 3. A user follows the documented `npm install -g mcporter` command, which retrieves the current registry-selected release without an exact version or integrity check. 4. The malicious package executes installation-time code, or its executable runs when the Skill invokes `mcporter`. 5. The compromised executable receives DingTalk MCP requests and may access the confi ...[truncated 983 chars]- Remediation
View remediation