T08 · Insecure Dependencies
- Location
SKILL.md:105- Finding
Unpinned npm Package Downloaded and Executed via npx
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 105–109
Vulnerability Type:T08: Insecure Dependencies
Risk Level: HighVulnerable code:
markdown If your runtime supports MCP servers, the official server includes the free `verify_risk_attestation` tool plus 9 more treasury tools (requires Node.js): ```bash npx -y @gblin-protocol/mcp-servertext ### Technical Analysis The documented command uses `npx -y` to retrieve and execute `@gblin-protocol/mcp-server` from the configured npm registry without interactive confirmation. It does not pin an exact package version or provide an integrity hash, verified provenance, or another cryptographic binding to reviewed source code. Consequently, the code executed when the command is invoked can differ from the package version reviewed during the Skill audit. A compromised publisher account, malicious future release, registry compromise, or compromised transitive dependency could introduce arbitrary code. Linking to a source repository elsewhere in the document does not prove that the registry artifact being executed was built from the reviewed source. ### Attack Path 1. An attacker compromises the npm publisher account, package release pipeline, registry artifact, or a transitive dependency. 2. The attacker publishes a malicious package version or causes malicious dependency code to be resolved. 3. An Agent follows the Skill's instructions and runs: ```bash npx -y @gblin-protocol/mcp-server ``` 4. `npx` resolves and downloads the current package and dependencies without requiring confirmation. 5. Package lifecycle scripts or runtime code execute with the privileges of the Agent's operating-system account. 6. The malicious code accesses or modifies resources available to that account, potentially including local files, credentials, Agent state, network services, wallet tooling, or transaction-signing interfaces. ### Impact Asse ...[truncated 871 chars]- Remediation
View remediation
Remediation Suggestions
-
Replace the floating package reference with an exact, reviewed version, for example:
bash npx -y @gblin-protocol/mcp-server@1.2.3An exact version reduces unexpected upgrades but does not independently guarantee artifact integrity.
-
Publish and verify package provenance and integrity metadata. Document how users can confirm that the npm artifact was produced from the expected source commit and trusted build pipeline.
-
Review and lock the complete transitive dependency graph. Use a lockfile for a controlled installation workflow and perform dependency, provenance, and vulnerability scanning before execution.
-
Disable package lifecycle scripts where compatible, such as through a reviewed installation using
npm install --ignore-scripts. Explicitly verify whether the package requires any lifecycle scripts before enabling them. -
Avoid direct first-use execution through
npx. Prefer downloading into a controlled staging environment, verifying the artifact, and executing only after approval. -
Run the MCP server in a sandbox or container with minimal filesystem access, restricted outbound networking, no unnecessary environment variables, and no direct access to private keys.
-
Keep wallet signing behind a separate, policy-enforcing interface that displays and validates chain ID, destination contract, asset, amount, and calldata before approval. Do not expose unrestricted signing capabilities to the package process.
-
Document a trusted version, expected package digest, source commit, required permissions, and supported network destinations so operators can enforce least privilege.
-