T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:20
- Finding
- Unpinned Package Download and Execution Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-24` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ```json { "mcpServers": { "marine-weather": { "command": "npx", "args": ["-y", "@vbotholemu/mcp-marine-weather"] } } } ``` ### Technical Analysis The recommended configuration invokes `npx` with `-y` and a package name that has no exact version constraint. Consequently, setup can download and execute the package version currently selected by the package registry rather than a specifically reviewed release. The `-y` option automatically accepts installation prompts, removing an opportunity for the user to review the package and resolved version before execution. The repository also contains no lockfile or integrity value that binds this documented installation command to the audited source code. This does not demonstrate that the current package is malicious. It creates a supply-chain exposure in which a compromised registry account, malicious future release, or package ownership change could cause code different from the audited repository to execute. ### Attack Path 1. An attacker compromises the package publisher account or otherwise gains the ability to publish a release under `@vbotholemu/mcp-marine-weather`. 2. The attacker publishes a modified package containing malicious initialization or runtime code. 3. A user follows the documented MCP configuration without specifying an exact reviewed version. 4. `npx -y` retrieves the registry-selected package release and accepts installation without confirmation. 5. The package executable starts as the configured MCP server and runs attacker-controlled code under the MCP host user's account. ### Impact Assessment Successful exploitation permits arbitrary code execution with the operating-system privileges of the user running the MCP client. Depending on that user's access, attacker code could read or modify accessible files, in ...[truncated 371 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the command to an exact reviewed release, for example: ```json { "command": "npx", "args": ["@vbotholemu/mcp-marine-weather@1.0.0"] } ``` 2. Avoid `-y` where interactive confirmation is acceptable, so unexpected installation behavior remains visible. 3. Publish and document package integrity information or provenance attestations, and verify that the registry artifact corresponds to the reviewed source. 4. Use a lockfile and reproducible build process when installing the server as part of a managed deployment. 5. Protect the publisher account with phishing-resistant multifactor authentication, restricted publishing tokens, and automated provenance. 6. Review each new release before changing the pinned version. ]]>