T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:50
- Finding
- Unpinned Third-Party Package Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 50–54 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown **mcporter** (recommended): `mcporter call --stdio "npx -y @evolinkai/evolink-media@latest" list_models` **Claude Code:** `claude mcp add evolink-media -e EVOLINK_API_KEY=your-key -- npx -y @evolinkai/evolink-media@latest` **Claude Desktop / Cursor** — add MCP server with command `npx -y @evolinkai/evolink-media@latest` and env `EVOLINK_API_KEY=your-key`. See `references/video-api-params.md` for full config JSON. ``` ### Technical Analysis The setup instructions use `npx -y` to download and execute `@evolinkai/evolink-media@latest`. The `@latest` tag is mutable, so the package executed by users can differ from the version that existed when this skill was audited. The `-y` option suppresses the normal installation confirmation, further reducing opportunities for users to inspect what will run. The package is referenced through its official scoped npm name and associated project links, and there is no evidence in the audited files that the current package is malicious. Nevertheless, the absence of exact-version and integrity pinning creates a supply-chain trust boundary: compromise of the npm publisher account, package distribution channel, or a future release could replace the effective executable payload without modifying this repository. Because the package is configured with `EVOLINK_API_KEY` in its environment, any malicious package version would be able to read that credential while running. It would also execute with the operating-system privileges of the user who launches the MCP server. ### Attack Path 1. An attacker compromises the npm publisher account, package release workflow, or another component of the package distribution channel. 2. The attacker publishes a malicious release and assigns it to the mutable `latest` distribution tag. 3. A user follows th ...[truncated 1159 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version, for example: ```bash npx -y @evolinkai/evolink-media@2.0.1 ``` 2. Review the selected release before recommending it and update the pinned version only through a controlled security-review process. 3. Where the installation environment permits, use a lockfile and verify the package's resolved version and integrity hash. 4. Avoid silently accepting package execution when practical. Remove `-y` for interactive installation flows or clearly warn users that the command downloads and executes third-party code. 5. Run the MCP server under a dedicated, least-privileged account or sandbox with access only to required files and network destinations. 6. Provide the API key only to the MCP process, avoid exposing unrelated secrets in its environment, and use a narrowly scoped or revocable credential if the service supports one. 7. Document package provenance, the expected npm publisher, and a verification procedure so users can detect unexpected ownership or release changes before execution.