T08 · Insecure Dependencies
Warning
- Location
README.md:14- Finding
Unpinned npm Packages Executed Through npx
- Content
View full analysis
" ] } } } ``` Equivalent instructions also appear in `README.zh.md` and `SECURITY.md`. ### Technical Analysis The documentation directs users to execute the `skills` and `mcp-remote` npm packages through `npx` without an exact version, lockfile, or integrity constraint. Depending on local npm behavior and package availability, `npx` can download the current package release from the configured npm registry and execute its lifecycle or entry-point code with the privileges of the user running the Agent application. Because the effective package contents may change after this Skill has been audited, compromise of the package publisher, npm account, registry, or transitive dependency chain could introduce arbitrary local code execution. The `mcp-remote` process is particularly sensitive because the configuration supplies an API key in its command-line arguments. No evidence establishes that the currently published packages are malicious. The vulnerability is the unsafe, mutable dependency execution model. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution channel, or a transitive dependency used by `skills` or `mcp-remote`. 2. The attacker publishes a malicious release under the same package name. 3. A user fol ...[truncated 892 chars]- Remediation
View remediation
add hypier/tradingview-quantitative-skills ``` and: ```json { "command": "npx", "args": [ "--no-install", "mcp-remote", "https://mcp.rapidapi.com" ] } ``` 2. Install dependencies locally from a lockfile before use, then invoke them with `npx --no-install` so startup cannot silently download a new release. 3. Commit and review an npm lockfile where applicable, and verify registry integrity hashes during installation. 4. Document the canonical npm publisher, source repository, expected package name, and reviewed version to reduce dependency-confusion and typosquatting risks. 5. Audit package lifecycle scripts and transitive dependencies before approving upgrades. 6. Avoid exposing API keys directly in process arguments. Use a supported secret store or environment-to-header mechanism that does not make the value visible in command listings. 7. Run the MCP process under a minimally privileged account with access only to the resources required for market-data requests. ]]>