T08 · Insecure Dependencies
Warning
- Location
- setup.md:30
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed with API Credentials## Vulnerability Details **File Location**: `setup.md:30-40`, `setup.md:51-56`, and `setup.md:85` **Vulnerability Type**: Unpinned dependency execution and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code The Cursor configuration downloads and executes an npm package without specifying an immutable version: ```json { "mcpServers": { "a2amarket": { "command": "npx", "args": ["-y", "@hz-abyssal-heart/a2amarket-mcp-server"], "env": { "A2AMARKET_API_KEY": "ak_your_key_here" } } } } ``` The Claude Desktop configuration recommends the same unpinned execution pattern: ```json { "mcpServers": { "a2amarket": { "command": "npx", "args": ["-y", "@hz-abyssal-heart/a2amarket-mcp-server"], "env": { "A2AMARKET_API_KEY": "ak_your_key_here" } } } } ``` The SSE setup also executes the package without a pinned version: ```bash npx @hz-abyssal-heart/a2amarket-mcp-server --sse --port 3100 ``` The documentation provides the following warning, but it does not technically mitigate the risk: ```text Security notice: npx downloads and executes external code from npm. Confirm that the package name @hz-abyssal-heart/a2amarket-mcp-server is correct and review its behavior before first use. ``` ### Technical Analysis The documented `npx` commands resolve `@hz-abyssal-heart/a2amarket-mcp-server` from the npm registry at execution time. Because no exact package version, lockfile, or integrity digest is specified, the effective executable payload can change after this Skill has been reviewed. The use of `-y` automatically accepts installation prompts, reducing the opportunity for users to inspect the resolved version before execution. In the desktop configurations, the downloaded process is also explicitly given `A2AMARKET_API_KEY` through its environment. Any code executed by the package can read that credential. This is a supply-chain weakness rather than evidence that the cur ...[truncated 1822 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the MCP server to a reviewed exact version rather than resolving the latest release: ```json "args": ["@hz-abyssal-heart/a2amarket-mcp-server@1.2.3"] ``` 2. Publish and verify the expected npm integrity digest and package provenance. Prefer a controlled installation using a lockfile and `npm ci` over runtime installation through `npx`. 3. Remove `-y` so users can inspect the package and resolved version before first execution. 4. Document a review process for package upgrades. Each version change should be independently audited before the pinned version is updated. 5. Run the MCP server in a sandbox, container, or dedicated low-privilege operating-system account with restricted filesystem and network access. 6. Supply a restricted, low-balance API key with only the permissions needed by the MCP server. Do not reuse administrative or production credentials. 7. Rotate the API key immediately if an unexpected package version has been executed or package compromise is suspected. 8. Keep the REST-only Skill as the preferred option where possible because it does not require executing the external npm package.