T08 · Insecure Dependencies
- Location
SKILL.md:76- Finding
Unverified npm Package Is Fetched and Executed at Runtime
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 76-83
Vulnerability Type: Supply-chain exposure through runtime dependency retrieval
Risk Level: MediumVulnerable Code
json { "mcpServers": { "tced-mcp": { "command": "npx", "args": ["-y", "tced-mcp@1.0.2"], "env": { "TCED_PAN_DOMAIN": "https://pan.tencent.com", "TCED_BASE_PATH": "https://api.tencentsmh.cn" } } } }Technical Analysis
The recommended configuration uses
npx -yto resolve and execute the externaltced-mcp@1.0.2npm package. Pinning a specific version reduces exposure to unintended future upgrades, but it does not authenticate the package contents. This project does not include the dependency source, a lockfile containing an integrity hash, a verified signature, or reproducible-build provenance.Consequently, the security-sensitive implementation cannot be audited from this artifact. The external package handles OAuth authentication, token storage, network communications, and local file upload and download operations. If the npm publisher account, package release, registry response, dependency graph, or local npm cache is compromised, attacker-controlled code could execute with the privileges of the MCP client.
The audited artifact does not establish that
tced-mcp@1.0.2is malicious. The confirmed issue is the unsafe trust model in which externally supplied executable code is retrieved and run without artifact-level integrity verification.Attack Path
- An attacker compromises the npm publisher account, package artifact, registry delivery path, transitive dependency, or local npm cache associated with
tced-mcp@1.0.2. - A user installs the documented MCP configuration and restarts the MCP client.
- The client invokes
npx -y tced-mcp@1.0.2. npxresolves the package from the registry or cache and executes it without an integrity value ...[truncated 1158 chars]
- An attacker compromises the npm publisher account, package artifact, registry delivery path, transitive dependency, or local npm cache associated with
- Remediation
View remediation
Remediation Suggestions
- Avoid fetching executable packages at MCP startup. Install the dependency through a controlled build or deployment process and execute a locally verified artifact.
- Maintain a lockfile that records cryptographic integrity metadata for the package and all transitive dependencies.
- Vendor or otherwise make the complete MCP server source available for review alongside the Skill.
- Publish and verify package provenance, such as npm provenance attestations and signed release artifacts.
- Verify the package tarball digest against an independently maintained expected value before installation or execution.
- Use a private, allowlisted package registry or an approved internal artifact repository where practical.
- Run the MCP server in a sandbox with access restricted to required files and official network endpoints.
- Ensure
~/.tced-mcp/auth.jsonis readable and writable only by its owner, and minimize the OAuth scopes granted to the MCP server. - Review package changes and transitive dependency updates before adopting a new pinned version.