T08 · Insecure Dependencies
- Location
docs/TROUBLESHOOTING.md:79- Finding
Unpinned Third-Party MCP Package Installation and Execution
- Content
View full analysis
Vulnerability Details
File Location:
docs/TROUBLESHOOTING.md:79-91
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: MediumVulnerable Code
json { "playwright": { "command": "npx", "args": ["playwright-mcp"] } }bash npm install -g playwright-mcp npx playwright installTechnical Analysis
The troubleshooting guide instructs users to install and execute
playwright-mcpwithout specifying an exact package version or verifying package integrity. The MCP configuration also launches the package throughnpxusing an unversioned package name.Consequently, the code executed can change after the Skill has been reviewed. If the npm package, maintainer account, publication process, or dependency chain is compromised, following these instructions could install and execute attacker-controlled code. Global installation increases exposure by making the package persist in the user's system-wide npm environment.
The package is intended to provide browser automation and may run with access to the user's project directory, inherited environment variables, browser state, and network. These capabilities make dependency authenticity and version control security-sensitive.
Attack Path
- An attacker compromises the
playwright-mcppackage, its maintainer account, or a transitive dependency. - The attacker publishes a malicious release under the package name resolved by npm.
- A user follows the troubleshooting instructions and runs
npm install -g playwright-mcp, or configures the MCP server to invoke the unversioned package throughnpx. - npm retrieves the uncontrolled release and executes its installation or runtime code.
- The malicious code runs with the invoking user's privileges and accesses resources available to the MCP process.
- Depending on the local environment, the payload could inspect project files, read inherited cred ...[truncated 801 chars]
- An attacker compromises the
- Remediation
View remediation
Remediation Suggestions
- Pin the MCP package to an exact, audited version in both installation and configuration instructions, rather than relying on the latest npm resolution.
- Verify the authoritative package name and publisher, preferably using an official scoped package when one is available.
- Record and verify the package integrity hash through a lockfile or equivalent integrity mechanism.
- Avoid global installation. Install the dependency in a dedicated project or isolated tool directory with a committed lockfile.
- Configure
npxso it cannot silently download an absent package at runtime, and invoke a previously installed, verified binary instead. - Review the pinned package and its transitive dependencies before upgrades. Apply dependency scanning and require explicit approval for version changes.
- Run the MCP server in a restricted environment with only the project paths, environment variables, browser profiles, and network destinations required for testing.
- Remove credentials and unrelated secrets from the MCP process environment, and use a dedicated browser profile without unrelated authenticated sessions.