T08 · Insecure Dependencies
Error
- Location
- SKILL.md:15
- Finding
- Unpinned Third-Party Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 15-27 **Vulnerability Type**: Unpinned and automatically executed npm dependency **Risk Level**: High **Vulnerable Code:** ```json Add to `.mcp.json` in your project or `~/.claude/mcp.json`: { "mcpServers": { "kiaaccess": { "command": "npx", "args": ["-y", "kiaaccess-mcp"], "env": { "KIA_USERNAME": "you@example.com", "KIA_PASSWORD": "your-password", "KIA_WRITE_MODE": "comfort" } } } } ``` ### Technical Analysis The documented configuration invokes `npx` with `-y` and a package name that has no exact version or integrity constraint. Consequently, npm can retrieve and execute whichever package release the registry currently resolves as the latest version. The `-y` option suppresses the interactive installation prompt, reducing the opportunity for users to notice an unexpected package or version. The audited project contains only `SKILL.md`; it does not include the MCP server source, a lockfile, an integrity hash, or other material that would allow the downloaded executable to be verified against the reviewed Skill. The code that ultimately executes can therefore change after this Skill has been audited. This behavior is particularly sensitive because the child process receives the user's Kia username and password through its environment. It also provides functionality involving vehicle location and remote vehicle commands. Although using the external package is necessary to provide the declared integration, automatically executing an unpinned release exceeds the minimum safe dependency privileges. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry resolution, or another component of the package supply chain. 2. The attacker publishes a malicious release under the `kiaaccess-mcp` package name. 3. A user starts the configured MCP s ...[truncated 1126 chars]
- Remediation
- ## Remediation Suggestions - Pin the MCP package to a reviewed exact version, such as `kiaaccess-mcp@X.Y.Z`, rather than relying on the current registry release. - Remove `-y` where practical so installation or version changes are not silently accepted. - Install dependencies through a committed lockfile and verify npm integrity metadata. - Review the source and release artifacts for the pinned version before deployment. - Prefer a locally installed, verified executable over downloading code during every launch. - Run the MCP server in a sandbox or container with narrowly scoped filesystem and network access. - Restrict the process environment to only the secrets and variables it requires. - Establish an explicit, reviewed update procedure instead of automatically consuming new releases.