T08 · Insecure Dependencies
Error
- Location
- SKILL.md:5
- Finding
- Automatic Execution of an Unpinned npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 5–9 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: High ### Vulnerable Code ```yaml mcp-server: command: npx args: ["-y", "noverload-mcp@latest"] env: NOVERLOAD_CONFIG: '{"accessToken":"${NOVERLOAD_TOKEN}","apiUrl":"https://www.noverload.com","readOnly":true}' ``` The behavior is also described at line 51: ```text The skill spawns the Noverload MCP server automatically via npx when activated. ``` ### Technical Analysis The Skill invokes `npx` with the mutable package reference `noverload-mcp@latest`. The `latest` tag does not identify a fixed, previously audited artifact; it resolves to whichever package release the publisher currently designates. Consequently, the code executed during activation can change after this Skill has been reviewed. The `-y` option automatically accepts installation prompts, so package retrieval and execution occur without an additional confirmation step. No exact version, lockfile, package integrity hash, or signature is specified. An attacker who compromises the npm package, its publisher account, or the package distribution process could therefore introduce arbitrary code into a future release. Although the configured MCP mode is read-only at the application level, that setting does not sandbox the npm process itself. Package lifecycle code and the launched MCP server execute with the operating-system permissions of the agent process and can access inherited environment variables, including `NOVERLOAD_TOKEN`. ### Attack Path 1. An attacker compromises the `noverload-mcp` npm package, its maintainer account, or the package publication pipeline. 2. The attacker publishes a malicious release and assigns it to the npm `latest` distribution tag. 3. A user activates the Skill. 4. The Skill executes `npx -y noverload-mcp@latest`. 5. `npx` retrieves and runs the attacker-cont ...[truncated 984 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `noverload-mcp@latest` with an exact, reviewed version, such as `noverload-mcp@1.2.3`. 2. Verify the package against a trusted lockfile and npm integrity hash before execution. 3. Establish a controlled update process in which each new version is reviewed and tested before changing the pinned version. 4. Avoid `npx -y` for automatic retrieval and execution where possible. Prefer a preinstalled, verified dependency from a controlled deployment process. 5. Run the MCP server in a sandbox or isolated container with narrowly scoped filesystem and network access. 6. Expose only the required environment variable to the MCP process and prevent access to unrelated credentials. 7. Use a least-privilege, revocable Noverload token and retain read-only mode unless write capabilities are explicitly required. 8. Monitor package provenance and publisher changes, and verify signatures or attestations when supported.