T08 · Insecure Dependencies
Error
- Location
- SKILL.md:23
- Finding
- Automatic Execution of an Unpinned npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 23–34 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: High ### Vulnerable Code ```markdown Add to `.mcp.json` in your project or `~/.claude/mcp.json`: ```json { "mcpServers": { "opentable": { "command": "npx", "args": ["-y", "opentable-mcp"] } } } ``` ``` ### Technical Analysis The recommended configuration executes `opentable-mcp` using `npx -y` without specifying an exact version or package integrity value. The `-y` option suppresses the normal installation confirmation, while the absence of a version pin allows npm to resolve a package release that may differ from the release originally reviewed. This creates a mutable supply-chain execution path. Compromise of the npm package, its maintainer account, the registry entry, or a transitive dependency could cause attacker-controlled JavaScript and npm lifecycle scripts to execute when the MCP server is launched. The alternative source installation documented later in the file also clones a mutable repository branch and runs `npm install && npm run build` without pinning a reviewed commit. It therefore presents a similar, although separately delivered, supply-chain risk. ### Attack Path 1. An attacker compromises the `opentable-mcp` npm package, a maintainer account, or one of its resolved dependencies. 2. The attacker publishes a malicious package version or modifies an install-time dependency. 3. A user follows the recommended MCP configuration. 4. The MCP client invokes `npx -y opentable-mcp`. 5. `npx` automatically retrieves and executes the currently resolved package without user confirmation. 6. The malicious package runs with the operating-system privileges of the user running the Agent or MCP client. 7. It may access resources available to that user, alter local files, steal locally accessible data, or misuse the authenticated browser relay. ### Impact Assessment Suc ...[truncated 632 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the floating package reference with an exact, reviewed version, for example: ```json { "command": "npx", "args": ["--no-install", "opentable-mcp@<reviewed-version>"] } ``` 2. Install the reviewed package separately using a lockfile and verified npm integrity metadata, then prevent `npx` from downloading a replacement at runtime. 3. Remove `-y` so package installation or replacement cannot occur silently. 4. Publish checksums, signatures, provenance attestations, and reproducible build instructions for approved artifacts. 5. Audit and lock transitive dependencies with `npm ci` and a committed lockfile. 6. For source installation, pin the clone to a reviewed commit SHA rather than a mutable branch: ```bash git clone https://github.com/chrischall/opentable-mcp cd opentable-mcp git checkout <reviewed-commit-sha> npm ci --ignore-scripts ``` 7. Review all required lifecycle scripts before enabling them. 8. Run the MCP process in a sandbox with minimal filesystem, environment-variable, process, and network access. ]]>