T08 · Insecure Dependencies
- Location
references/mcp-setup.md:11- Finding
Unpinned Third-Party MCP Server Executes with Wallet Private-Key Access
- Content
View full analysis
Vulnerability Details
File Location:
references/mcp-setup.md:11-40
Vulnerability Type: Supply-chain exposure through unpinned and unverifiable dependencies
Risk Level: HighVulnerable Code
json { "mcpServers": { "etherlink": { "command": "npx", "args": ["-y", "etherlink-mcp-server"], "env": { "NETWORK": "etherlink", "PRIVATE_KEY": "optional-for-write-operations" } } } }bash # Clone the repo git clone https://github.com/yourusername/etherlink-mcp-server.git cd etherlink-mcp-server # Install dependencies bun install # Build bun run build # Run bun run startTechnical Analysis
The recommended configuration uses
npx -y etherlink-mcp-server, which automatically downloads and executes a package without pinning an exact version or verifying its integrity. The executed package may receive the user's blockchain private key through thePRIVATE_KEYenvironment variable.The alternative installation method is also not reproducible or verifiable. It references the placeholder repository
github.com/yourusername/etherlink-mcp-server.git, does not pin an immutable commit or release, and installs dependencies usingbun installwithout a demonstrated trusted lockfile. The MCP implementation and dependency manifests are not included in the audited project, so their behavior cannot be validated.Because both installation methods execute remotely sourced code, future package releases, repository changes, dependency compromise, dependency confusion, or account takeover could change the effective code after this Skill has been reviewed.
Attack Path
- An attacker compromises, replaces, or publishes a malicious version of
etherlink-mcp-server, its repository, or one of its transitive dependencies. - A user follows the recommended setup and executes the package through
npx -y, or clones the unpin ...[truncated 1266 chars]
- An attacker compromises, replaces, or publishes a malicious version of
- Remediation
View remediation
Remediation Suggestions
- Replace the placeholder repository with a verified, organization-controlled official repository.
- Pin the npm package to an exact reviewed version rather than using an unconstrained package name.
- Pin source installations to a reviewed immutable commit hash or cryptographically signed release.
- Commit and enforce a dependency lockfile, and use frozen-lockfile installation modes in production.
- Verify package integrity, provenance, release signatures, and publisher identity before execution.
- Avoid
npx -y; require explicit user approval and version selection before downloading executable code. - Include the MCP server source and dependency metadata within the auditable release, or provide reproducible build instructions and verified artifacts.
- Omit
PRIVATE_KEYentirely for read-only operations. - For write operations, use a dedicated low-value wallet with narrowly limited permissions instead of a primary wallet.
- Prefer an external signer, hardware wallet, or transaction-approval mechanism so the MCP process never receives raw private-key material.
- Run the MCP server in a restricted container or sandbox with minimal filesystem, network, environment, and operating-system privileges.
- Require explicit confirmation of destination, network, amount, contract address, and calldata before signing state-changing transactions.