T08 · Insecure Dependencies
Error
- Location
scripts/setup_glm_mcp_servers.py:32- Finding
Unpinned npm Package Is Downloaded and Executed Automatically
- Content
View full analysis
None: run([ "mcporter", "--config", config_path, "config", "add", "zai-vision", "--command", "npx", "--arg", "-y", "--arg", "@z_ai/mcp-server", "--env", f"Z_AI_API_KEY={api_key}", "--env", "Z_AI_MODE=ZAI", ]) ``` The same mutable invocation is documented in `SKILL.md:45`, `SKILL.md:89`, `references/official-endpoints.md:14`, and `references/test-report.md:42`: ```text npx -y @z_ai/mcp-server ``` ### Technical Analysis The configured vision server uses `npx -y` to retrieve and execute `@z_ai/mcp-server` without an exact version, lockfile, or verified integrity hash. Consequently, the code executed on a future invocation can differ from the code that was reviewed. The `-y` option suppresses installation confirmation, and the downloaded package is launched with the Z.AI API key in its environment. A compromised npm publisher account, registry response, package distribution process, or malicious future release could therefore turn a routine vision-server invocation into arbitrary local code execution. ### Attack Path 1. An attacker compromises the npm package publisher, package account, registry delivery path, or a future package release. 2. The attacker publishes malicious code under the version currently selected for `@z_ai/mcp-server`. 3. A user runs the setup workflow and later invokes the configured vision MCP server. 4. `npx -y` automatically retrieves and executes the mutable package release. 5. The malicious package executes with the user's operating-system privileges. 6. Because the process receives `Z_AI_API_KEY`, the package can read and disclose that credential in ...[truncated 743 chars]- Remediation
View remediation