T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:20
- Finding
- Execution of Unpinned Third-Party Package and Repository Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20-45 **Vulnerability Type**: Unpinned and mutable third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "viator": { "command": "npx", "args": ["-y", "@chrischall/viator-mcp"], "env": { "VIATOR_API_KEY": "your-viator-partner-api-key" } } } } ``` ```bash git clone https://github.com/chrischall/viator-mcp cd viator-mcp npm install && npm run build ``` ### Technical Analysis The recommended `npx` configuration executes `@chrischall/viator-mcp` without specifying an exact version or validating an integrity hash. The `-y` option automatically approves installation, removing an opportunity for the user to review the package and resolved version before execution. The alternative source installation is also mutable: it clones the repository's current default branch rather than an audited commit or signed release, then installs dependencies and runs the package build process. Both `npm install` and the MCP server can execute package-controlled JavaScript, including npm lifecycle scripts. Consequently, code executed after the Skill was reviewed may differ from the reviewed implementation. There is no evidence in the audited file that the named package or repository is currently malicious; the vulnerability is the absence of version pinning and integrity verification. ### Attack Path 1. An attacker compromises the npm publisher account, source repository, or an upstream dependency. 2. The attacker publishes malicious package content or modifies the repository's default branch. 3. A user follows the documented setup and runs the unpinned `npx -y` command or clones and builds the current repository content. 4. The modified package executes with the permissions of the MCP host user. 5. The malicious code can read the configured `VIATOR_API_KEY` and access other files, environment variables, and network res ...[truncated 506 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@chrischall/viator-mcp` to an exact, reviewed version rather than resolving the latest release: ```json "args": ["@chrischall/viator-mcp@<audited-exact-version>"] ``` 2. Avoid `npx -y`; require explicit review and confirmation of the resolved package and version. 3. For source installation, check out a specific audited commit or signed release tag instead of the mutable default branch. 4. Verify release signatures, npm provenance, and package integrity hashes before execution. 5. Commit and enforce a reviewed lockfile for source builds, and use a deterministic installation command such as `npm ci`. 6. Disable or separately review npm lifecycle scripts where operationally possible. 7. Run the MCP server under a restricted account or sandbox with only the filesystem and network access required for Viator API queries. ]]>