T08 · Insecure Dependencies
- Location
setup.md:30- Finding
Unpinned Third-Party Package Is Downloaded and Executed with API Credentials
- Content
View full analysis
Vulnerability Details
File Location:
setup.md:30-40,setup.md:51-56, andsetup.md:85
Vulnerability Type: Unpinned dependency execution and supply-chain exposure
Risk Level: MediumVulnerable Code
The Cursor configuration downloads and executes an npm package without specifying an immutable version:
json { "mcpServers": { "a2amarket": { "command": "npx", "args": ["-y", "@hz-abyssal-heart/a2amarket-mcp-server"], "env": { "A2AMARKET_API_KEY": "ak_your_key_here" } } } }The Claude Desktop configuration recommends the same unpinned execution pattern:
json { "mcpServers": { "a2amarket": { "command": "npx", "args": ["-y", "@hz-abyssal-heart/a2amarket-mcp-server"], "env": { "A2AMARKET_API_KEY": "ak_your_key_here" } } } }The SSE setup also executes the package without a pinned version:
bash npx @hz-abyssal-heart/a2amarket-mcp-server --sse --port 3100The documentation provides the following warning, but it does not technically mitigate the risk:
text Security notice: npx downloads and executes external code from npm. Confirm that the package name @hz-abyssal-heart/a2amarket-mcp-server is correct and review its behavior before first use.Technical Analysis
The documented
npxcommands resolve@hz-abyssal-heart/a2amarket-mcp-serverfrom the npm registry at execution time. Because no exact package version, lockfile, or integrity digest is specified, the effective executable payload can change after this Skill has been reviewed.The use of
-yautomatically accepts installation prompts, reducing the opportunity for users to inspect the resolved version before execution. In the desktop configurations, the downloaded process is also explicitly givenA2AMARKET_API_KEYthrough its environment. Any code executed by the package can read that credential.This is a supply-chain weakness rather than evidence that the cur ...[truncated 1822 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin the MCP server to a reviewed exact version rather than resolving the latest release:
json "args": ["@hz-abyssal-heart/a2amarket-mcp-server@1.2.3"]-
Publish and verify the expected npm integrity digest and package provenance. Prefer a controlled installation using a lockfile and
npm ciover runtime installation throughnpx. -
Remove
-yso users can inspect the package and resolved version before first execution. -
Document a review process for package upgrades. Each version change should be independently audited before the pinned version is updated.
-
Run the MCP server in a sandbox, container, or dedicated low-privilege operating-system account with restricted filesystem and network access.
-
Supply a restricted, low-balance API key with only the permissions needed by the MCP server. Do not reuse administrative or production credentials.
-
Rotate the API key immediately if an unexpected package version has been executed or package compromise is suspected.
-
Keep the REST-only Skill as the preferred option where possible because it does not require executing the external npm package.