T08 · Insecure Dependencies
Error
- Location
- bin/start-mcp.sh:3
- Finding
- Unpinned npm Package Is Downloaded and Executed Without Integrity Verification## Vulnerability Details **File Location**: `bin/start-mcp.sh`, line 3; also documented in `SKILL.md`, line 24 **Vulnerability Type**: Insecure third-party dependency execution **Risk Level**: High ### Vulnerable Code `bin/start-mcp.sh:1-3`: ```bash #!/usr/bin/env bash # Starts the Human Pages MCP server via npx exec npx -y humanpages ``` Related setup instruction in `SKILL.md:24`: ```text mcporter config add humanpages --command "npx -y humanpages" ``` ### Technical Analysis The skill invokes `npx -y humanpages` without specifying an exact package version or validating a cryptographic integrity hash. If the package is not already available in a suitable local cache, `npx` can retrieve it from the configured npm registry and immediately execute it. The `-y` option suppresses the installation confirmation. As a result, the files reviewed in this project do not fully determine the code that runs. A future package release, compromised publisher account, malicious registry response, dependency compromise, or poisoned npm configuration could cause different code to execute without any modification to this repository. This is primarily an insecure dependency and supply-chain issue. It also creates a remote payload retrieval and execution channel because mutable external code is fetched at invocation time. ### Attack Path 1. An attacker compromises the `humanpages` npm publisher, its release process, a transitive dependency, or a registry/network path trusted by the local npm configuration. 2. The attacker publishes or serves a malicious version of the package. 3. A user invokes `bin/start-mcp.sh` or follows the command documented in `SKILL.md`. 4. `npx -y humanpages` obtains the remotely supplied package without asking the user to approve the installation. 5. npm lifecycle code or the package entry point executes with the privileges and environment of the invoking process. 6. The malicious code can access resources available to that process, potentially in ...[truncated 983 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the floating package reference with an exact, reviewed version, for example: ```bash exec npx -y --package humanpages@X.Y.Z humanpages ``` Confirm the correct executable syntax for the selected package before deployment. 2. Prefer installing dependencies during a controlled build or deployment phase rather than downloading them when the skill is invoked. 3. Commit a lockfile generated by a supported package manager and enforce lockfile-only or frozen-lockfile installation. 4. Verify package provenance and integrity. Pin expected registry metadata and integrity hashes where the deployment system supports doing so. 5. Explicitly configure and validate the trusted npm registry. Do not inherit arbitrary user-controlled registry settings in security-sensitive deployments. 6. Audit the pinned package, its lifecycle scripts, and its complete transitive dependency graph before release. Use automated dependency and provenance checks in CI. 7. Run the MCP server in a restricted environment with: - Only the required environment variables. - Minimal filesystem access. - No unnecessary host credentials. - Restricted outbound network access. - A dedicated, unprivileged operating-system account or container. 8. Require deliberate review and version updates rather than automatically accepting the newest registry release. 9. Update both `bin/start-mcp.sh` and the setup command in `SKILL.md` so documentation cannot reintroduce the unsafe floating invocation.