T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:20
- Finding
- Unpinned Remote Package Execution and Inconsistent Package Identity## Vulnerability Details **File Location**: `SKILL.md:20-25`, `README.md:18-24`, `package.json:2` **Vulnerability Type**: Unpinned third-party package execution and package identity mismatch **Risk Level**: Medium ### Vulnerable Code `SKILL.md:20-25`: ```json { "mcpServers": { "charter-planner": { "command": "npx", "args": ["-y", "@vbotholemu/mcp-charter-planner"] } } } ``` `README.md:18-24`: ```json { "mcpServers": { "charter-planner": { "command": "npx", "args": ["-y", "@velocibot/mcp-charter-planner"] } } } ``` `package.json:2`: ```json "name": "@vbotholemu/mcp-charter-planner", ``` ### Technical Analysis The documented configuration executes an npm registry package through `npx -y` without pinning an exact version or verifying package integrity. Consequently, the code executed on a user's system is the package version currently resolved by npm, rather than a fixed artifact corresponding to the audited source. The `-y` option suppresses the package-installation confirmation prompt. If the package is absent from the local cache, `npx` may download it and immediately execute its declared binary. Any future package release, compromised maintainer account, or malicious registry artifact can therefore change the effective executable after this source has been reviewed. There is also an identity inconsistency: `SKILL.md` and `package.json` identify the package as `@vbotholemu/mcp-charter-planner`, while `README.md` instructs users to execute `@velocibot/mcp-charter-planner`. These are distinct npm package identities. A user following the README may execute a package that does not correspond to the reviewed project. No malicious behavior was found in the reviewed TypeScript implementation itself. The risk arises from the mutable and inconsistent external installation instructions. ### Attack Path 1. An attacker publishes or gains co ...[truncated 1466 chars]
- Remediation
- ## Remediation Suggestions 1. Choose one verified npm package identity and use it consistently in `SKILL.md`, `README.md`, and `package.json`. 2. Pin the package to an exact reviewed version, for example: ```json { "command": "npx", "args": ["--yes", "@vbotholemu/mcp-charter-planner@1.0.0"] } ``` 3. Prefer installing from a lockfile-controlled deployment or a verified local artifact rather than resolving a mutable package every time the MCP server starts. 4. Publish and verify package provenance, checksums, and registry ownership. Where supported, enforce npm provenance attestations and integrity validation. 5. Avoid automatic confirmation suppression when package retrieval is unexpected. Clearly inform users that `npx` may download and execute external code. 6. Run the MCP server as a dedicated, least-privileged user without unnecessary credentials, sensitive environment variables, or write access to important files. 7. Add release controls such as mandatory multifactor authentication, protected publishing workflows, dependency review, and automated package-content comparison against the audited source.