T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:54
- Finding
- Execution of an Unpinned npm Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 54–58 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown **mcporter** (recommended): `mcporter call --stdio "npx -y @evolinkai/evolink-media@latest" list_models` **Claude Code:** `claude mcp add evolink-media -e EVOLINK_API_KEY=your-key -- npx -y @evolinkai/evolink-media@latest` **Claude Desktop / Cursor** — add MCP server with command `npx -y @evolinkai/evolink-media@latest` and env `EVOLINK_API_KEY=your-key`. See `references/image-api-params.md` for full config JSON. ``` ### Technical Analysis The documented setup commands download and execute `@evolinkai/evolink-media@latest`. The `latest` npm tag is mutable and does not identify the specific package version that was reviewed. Consequently, the code executed during installation can differ from the code originally assessed. The `npx -y` options automatically approve package installation, reducing the opportunity for the user to inspect the resolved package and version before execution. npm packages can run executable entry points and installation lifecycle scripts with the privileges of the invoking user. This is a supply-chain weakness rather than evidence that the currently published package is malicious. Exploitation would require compromise of the package, its publisher account, the npm distribution path, or a future release assigned to the `latest` tag. ### Attack Path 1. An attacker compromises the npm package, its publisher credentials, or its release process. 2. The attacker publishes a malicious version and assigns it to the mutable `latest` tag. 3. A user follows one of the documented setup commands. 4. `npx -y` resolves, downloads, and executes the attacker-controlled release without interactive confirmation. 5. The malicious package executes in the user's environment and may access resources available to that proces ...[truncated 759 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed version, for example: ```bash npx @evolinkai/evolink-media@1.2.3 ``` 2. Remove `-y` so users can review the package and resolved version before installation. 3. Where supported, pin and verify the package tarball integrity using a trusted checksum or npm lockfile. 4. Document a controlled upgrade procedure that requires reviewing release notes, package provenance, dependency changes, and integrity metadata before changing the pinned version. 5. Prefer installing from a lockfile-backed project rather than resolving the package dynamically each time the MCP server starts. 6. Run the MCP server with least privilege in an isolated environment, granting access only to the required API key and necessary files. 7. Use a narrowly scoped and revocable API key, and rotate it immediately if dependency compromise is suspected.