T08 · Insecure Dependencies
Warning
- Location
references/install-and-auth.md:7- Finding
Unpinned Third-Party Package Installation
- Content
View full analysis
Vulnerability Details
File Location:
references/install-and-auth.md:7-17
Vulnerability Type: Unpinned dependency installation from a mutable third-party package registry
Risk Level: MediumVulnerable Code:
bash Recommended method: ```bash uv tool install notebooklm-mcp-cliAlternative method:
bash pip install notebooklm-mcp-clitext ### Technical Analysis The installation instructions retrieve `notebooklm-mcp-cli` without specifying an exact version, validating a cryptographic hash, or using a reviewed lockfile. Consequently, the installed code depends on whichever package release the registry resolves at installation time. This creates a supply-chain risk because a compromised package publisher account, package registry, or malicious future release could cause users to install and execute unreviewed code. The project also does not document package integrity verification or bind installation to a specific reviewed artifact. ### Attack Path 1. An attacker compromises the package publisher account, registry distribution path, or a future release of `notebooklm-mcp-cli`. 2. The attacker publishes a malicious package version under the expected package name. 3. A user follows the documented `uv tool install` or `pip install` command. 4. The package manager resolves and installs the mutable malicious release because no version or hash is pinned. 5. Malicious installation behavior or subsequent execution of `nlm` runs with the privileges of the installing user. 6. The malicious code may access data and credentials available to that user, including NotebookLM or Google authentication state exposed to the CLI. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the installing user's privileges. The accessible scope may include the user's files, environment variables, CLI configuration, authentication profiles, and NotebookLM-related data a ...[truncated 261 chars]- Remediation
View remediation
Remediation Suggestions
- Pin
notebooklm-mcp-clito a specifically reviewed version in every installation command. - Distribute a lockfile or requirements file containing cryptographic hashes and require hash verification during installation.
- Document the canonical package repository, expected publisher, source repository, and release-signing or provenance information.
- Prefer installation in an isolated, least-privileged virtual environment rather than a global or privileged Python environment.
- Establish a controlled dependency-update process that reviews source changes and verifies package provenance before updating the pinned version.
- Where supported, verify signed release artifacts or trusted package provenance attestations before installation.
- Pin