T08 · Insecure Dependencies
Warning
- Location
- README.md:15
- Finding
- Unpinned and Inconsistently Named npm Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `README.md:15-24`; `SKILL.md:20-30` **Vulnerability Type**: Insecure package execution and supply-chain ambiguity **Risk Level**: Medium ### Vulnerable Code `README.md:15-24`: ```json { "mcpServers": { "company-search": { "command": "npx", "args": ["-y", "@blue-trianon/mcp-company-search"], "env": { "NAUTDEV_BASE_URL": "https://api.nautdev.com" } } } } ``` `SKILL.md:20-30`: ```json { "mcpServers": { "company-search": { "command": "npx", "args": ["-y", "@vbotholemu/mcp-company-search"], "env": { "L402_API_BASE_URL": "https://api.nautdev.com" } } } } ``` The package manifest identifies the project as `@vbotholemu/mcp-company-search`, while the README instructs users to execute `@blue-trianon/mcp-company-search`. Neither command pins a package version or integrity digest. ### Technical Analysis `npx -y` automatically downloads and executes the package selected by the npm registry without asking the user for confirmation. Because no version is specified, npm resolves the current distribution tag, normally `latest`, each time the command is installed or executed in a fresh environment. The conflicting package scopes create ambiguity about which publisher and package are authoritative: - `package.json` and `SKILL.md` identify `@vbotholemu/mcp-company-search`. - `README.md` directs users to `@blue-trianon/mcp-company-search`. Consequently, reviewed source code in this repository does not reliably identify the code that users will execute. If either referenced package is compromised, transferred, incorrectly published, or controlled by an unintended publisher, a future package version can run arbitrary JavaScript under the invoking user's account. npm lifecycle scripts may also execute during installation, before the MCP entry point itself starts. Th ...[truncated 1769 chars]
- Remediation
- ## Remediation Suggestions 1. Establish one canonical npm package name and use it consistently in `package.json`, `README.md`, and `SKILL.md`. 2. Verify ownership of the canonical npm scope and enable multi-factor authentication and provenance-backed publishing for maintainers. 3. Pin the documented package to a reviewed immutable version, for example: ```json { "command": "npx", "args": ["-y", "@vbotholemu/mcp-company-search@1.0.0"] } ``` 4. Prefer a controlled installation step using a lockfile and integrity-verified artifacts rather than downloading executable code automatically whenever the MCP server starts. 5. Publish checksums, npm provenance attestations, or signed release metadata so users can verify that the installed artifact corresponds to the reviewed source. 6. Add CI checks that reject inconsistent package names across documentation and metadata. 7. Review package lifecycle scripts and transitive dependencies before each release, and use exact or tightly controlled dependency versions where practical. 8. Run the MCP server under a restricted account or sandbox with minimal filesystem access, a filtered environment, and limited outbound network permissions.