T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:24
- Finding
- Unpinned npm Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, lines 24–32 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ```json { "mcpServers": { "stashdog": { "command": "npx", "args": [ "-y", "mcp-remote", "https://gmchczeyburroiyzefie.supabase.co/functions/v1/mcp-server/mcp" ] } } } ``` ### Technical Analysis The recommended configuration runs `npx -y mcp-remote` without specifying an exact package version or verifying package integrity. `npx` may download the package and its transitive dependencies from the configured npm registry at invocation time, while `-y` suppresses the installation confirmation. Consequently, the code executed by users can differ from the code that was available when this skill was audited. If the package, one of its dependencies, its maintainer account, or the registry resolution path is compromised, a malicious release could execute arbitrary code on the local system. The project contains no lockfile, checksum, signature-verification procedure, or other mechanism that constrains the fetched payload to a reviewed artifact. ### Attack Path 1. An attacker compromises the `mcp-remote` npm package, a transitive dependency, a publisher account, or the package-resolution path. 2. The attacker publishes or causes resolution to a malicious package version. 3. A user adopts the documented MCP configuration. 4. The MCP client invokes `npx -y mcp-remote` without an exact version constraint or interactive confirmation. 5. `npx` downloads and executes the attacker-controlled package with the privileges of the invoking user. 6. The malicious process can access resources available to that user and may subsequently launch additional actions. ### Impact Assessment Successful exploitation provides code execution with the privileges of the user running the MCP client. Depending on that user's environment and permissions, the malicious package could acces ...[truncated 375 chars]
- Remediation
- ## Remediation Suggestions - Pin `mcp-remote` to an audited exact version rather than resolving the latest available release, for example by using an exact `package@version` specification. - Remove `-y` where practical so an unexpected installation is not accepted automatically. - Prefer installing the dependency through a managed project with a committed lockfile and lockfile integrity metadata. - Verify the package's official publisher, repository, provenance, and release signatures or attestations before deployment. - Use an internal registry mirror or approved package allowlist for production environments. - Run the MCP proxy under a dedicated, least-privileged account or sandbox with restricted filesystem, environment-variable, credential, and network access. - Establish a controlled update process in which new versions and transitive dependency changes are reviewed before rollout.