T08 · Insecure Dependencies
- Location
setup.sh:9- Finding
Unpinned Global npm Package Installation
- Content
View full analysis
Vulnerability Details
File Location:
setup.sh, lines 9–13
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: MediumVulnerable Code
bash # 检查 mcporter if ! command -v mcporter &> /dev/null; then echo "⚠️ 未找到 mcporter，正在安装..." npm install -g mcporter echo "✅ mcporter 安装完成" fiTechnical Analysis
The setup script installs the latest version of the
mcporternpm package without pinning a reviewed version or verifying package integrity or provenance. Because npm packages may execute lifecycle scripts during installation, the package registry response effectively determines what code runs when the setup script is executed.The
-goption installs the package globally rather than isolating it within the project. This expands the affected scope and may modify system-wide or user-wide npm binaries and package directories. If the package, publisher account, dependency tree, or configured npm registry is compromised, attacker-controlled code could execute with the privileges of the user runningsetup.sh.Attack Path
- An attacker compromises the
mcporterpackage, one of its dependencies, its publisher account, or the npm registry configured on the victim's system. - The attacker publishes or serves a malicious version containing an installation lifecycle script or malicious executable.
- A user follows the documented setup procedure and runs
bash setup.shon a system wheremcporteris not already installed. - The command
npm install -g mcporterresolves the unpinned package to the attacker-controlled version. - npm executes the malicious package or its lifecycle scripts with the invoking user's privileges.
- The payload may inspect the process environment, including
TENCENT_MEETING_TOKEN, alter the MCP configuration, replace globally available tooling, access user-readable files, or establish persistence where the user's permissions allow it.
Impact Assessmen
...[truncated 805 chars]
- An attacker compromises the
- Remediation
View remediation
Remediation Suggestions
-
Do not automatically install the package globally from the setup script. Treat
mcporteras a separately installed prerequisite and fail with clear, trusted installation instructions when it is absent. -
If automated installation is necessary, pin an exact reviewed version, for example:
bash npm install --global --ignore-scripts mcporter@<reviewed-exact-version> -
Confirm that
mcporterremains functional with--ignore-scripts; if lifecycle scripts are genuinely required, audit those scripts and all transitive dependencies before installation. -
Verify package provenance and integrity using a trusted lockfile, registry policy, package signatures or attestations, and a known integrity digest where supported.
-
Prefer project-local installation over global installation so the dependency is isolated and represented in a committed lockfile.
-
Configure an explicit trusted npm registry and reject unexpected registry overrides in security-sensitive deployment environments.
-
Run setup under a dedicated, least-privileged account. Never run the installation as root or an administrator.
-
Keep
TENCENT_MEETING_TOKENout of the environment during dependency installation. Request or load it only after all dependencies have been installed and verified. -
Document the reviewed package version and establish a controlled update process that includes dependency and lifecycle-script review before upgrading.
-