T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:26
- Finding
- Automatic Execution of an Unpinned Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md:26-27` and `SKILL.md:37-38` **Vulnerability Type**: Unpinned third-party dependency installation and execution **Risk Level**: Medium ### Vulnerable Code Public mode: ```json "command": "npx", "args": ["-y", "n2-free-search"] ``` Self-hosted mode: ```json "command": "npx", "args": ["-y", "n2-free-search"], "env": { "SEARXNG_URL": "http://localhost:8080" } ``` ### Technical Analysis Both documented configurations invoke `npx` with the automatic-confirmation option (`-y`) and an npm package name that has no exact version constraint. Consequently, npm can resolve, download, and execute a mutable package release at runtime without interactive approval. The artifact does not include the package implementation, a lockfile, an integrity hash, or other controls that bind execution to a reviewed artifact. Its declared repository metadata does not itself ensure that the npm registry package is identical to the reviewed repository source. This creates a supply-chain trust boundary outside the audited project. This finding does not establish that the current `n2-free-search` package is malicious. The risk is that a compromised npm package, maintainer account, publication pipeline, or future release could change executable behavior after this Skill has been reviewed. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or its release pipeline and publishes a malicious version under the existing package name. 2. A user applies either MCP configuration from `SKILL.md`. 3. The MCP client launches `npx -y n2-free-search`. 4. Because no exact version or integrity value is specified, npm resolves and downloads the attacker-controlled release. 5. `npx` executes the package locally without requesting confirmation. 6. Malicious package code runs with the operating-system identity, filesystem access, network access, environment variables, and other capabilities available to the MCP server ...[truncated 682 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the floating package reference with an exact, reviewed version, for example: ```json "args": ["n2-free-search@1.0.0"] ``` 2. Avoid automatic runtime installation where possible. Install the reviewed dependency during a controlled deployment phase and execute the installed binary afterward. 3. Commit and enforce a lockfile containing npm integrity metadata, and use reproducible installation commands such as `npm ci`. 4. Verify the package tarball's provenance and integrity against a trusted digest or signed release before deployment. 5. Review the actual npm package contents, lifecycle scripts, transitive dependencies, and correspondence with the declared source repository before approving a release. 6. Establish an explicit dependency-update process so that new versions require security review rather than being selected automatically at launch. 7. Run the MCP server under a dedicated, least-privileged account or sandbox with restricted filesystem, environment-variable, credential, and network access. 8. Disable unnecessary npm lifecycle scripts during installation where compatible with the package, and use trusted registry configuration to reduce dependency substitution risk.