T08 · Insecure Dependencies
Error
- Location
- SKILL.md:29
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, line 29 **Vulnerability Type**: Unpinned and mutable third-party dependency execution **Risk Level**: High **Complete Code Snippet**: ```bash mcporter config add vibe_kanban --command npx --arg -y --arg vibe-kanban@latest --arg --mcp ``` ### Technical Analysis The documented configuration registers `npx -y vibe-kanban@latest --mcp` as the command used to start the MCP server. The `@latest` tag is mutable and can resolve to a different package release over time. The `-y` option suppresses the package-installation confirmation, allowing the resolved package to be downloaded and executed without an explicit review step. No exact version, lockfile, integrity hash, or equivalent verification mechanism is specified. Consequently, the effective code executed by this configuration can change after the Skill has been reviewed. A compromised package publisher account, malicious upstream release, or compromised package distribution channel could cause attacker-controlled code to execute through an otherwise legitimate-looking MCP invocation. ### Attack Path 1. An attacker compromises the upstream npm package, its publisher account, or the package publication process. 2. The attacker publishes a malicious version and causes the mutable `latest` tag to resolve to it. 3. A user follows the Skill instructions and registers the provided `npx` command, or previously registered configuration invokes the command again. 4. `npx -y` downloads the malicious release without requesting installation confirmation. 5. The package executes as the MCP server with the permissions and environment of the user running `mcporter`. ### Impact Assessment Successful exploitation permits arbitrary code execution with the privileges of the invoking user. Depending on that user's access, malicious package code could read or modify accessible project files, configuration, environment variables, credent ...[truncated 385 chars]
- Remediation
- ## Remediation Suggestions - Replace `vibe-kanban@latest` with a reviewed, exact package version, such as `vibe-kanban@X.Y.Z`. - Remove unattended `-y` installation from persistent MCP configuration where practical, requiring explicit approval before first installation or upgrade. - Use a lockfile and npm integrity metadata, or an equivalent checksum verification mechanism, to ensure that the installed artifact matches the reviewed dependency. - Install the approved dependency through a controlled setup process and configure `mcporter` to execute that verified local installation rather than downloading code at runtime. - Review package ownership, release provenance, dependency changes, and published artifacts before upgrading. - Introduce an explicit update procedure so version changes are reviewed and tested rather than inherited automatically from the mutable `latest` tag. - Run the MCP server under a least-privileged account with restricted filesystem, credential, and network access to limit the consequences of a supply-chain compromise.