T08 · Insecure Dependencies
Warning
- Location
SKILL.md:148- Finding
Unpinned Third-Party MCP Package Is Downloaded and Executed
- Content
View full analysis
-- npx -y @marswave/listenhub-mcp-server ``` `references/listenhub-guide.md:3-7`: ```markdown ## MCP Server - **Package name**: `@marswave/listenhub-mcp-server` - **Environment variable**: `LISTENHUB_API_KEY` - **Claude Code installation**: `claude mcp add listenhub --env LISTENHUB_API_KEY= -- npx -y @marswave/listenhub-mcp-server` ``` ### Technical Analysis The installation command uses `npx -y` to retrieve and execute `@marswave/listenhub-mcp-server` without specifying an exact reviewed version or integrity value. Consequently, the effective code executed by users can change after the Skill itself has been audited. The `-y` option also suppresses interactive confirmation. If the package publisher account, package registry, release pipeline, or a future package version is compromised, following the documented command can immediately execute attacker-controlled package lifecycle or runtime code. The package is launched with `LISTENHUB_API_KEY` in its environment. A compromised release would therefore be able to read and disclose that credential in addition to exercising the normal filesystem, process, and network access of the account running the installation. ### Attack Path 1. An attacker compromises the package publisher, registry account, or upstream release process. 2. The attacker publishes a malicious version under the existing package name. 3. A user follows the Skill's documented `npx -y` installation command. 4. `npx` resolves the current package version because no exact version is pinned. 5. The malicious package executes with the privileges of the invoking account. 6. The package reads `LISTENHUB_ ...[truncated 888 chars]- Remediation
View remediation
``` 2. Commit and enforce a package lockfile where the deployment model supports it. 3. Verify package integrity through lockfile hashes, registry integrity metadata, or a separately published checksum. 4. Document the expected registry, package publisher, and approved package version. 5. Review new versions before updating the pinned dependency. 6. Run the MCP server under a dedicated, non-root account with access only to required project directories. 7. Provide the API key through a narrowly scoped secret mechanism and rotate it if package compromise is suspected. 8. Apply outbound network restrictions where practical so the process can communicate only with required ListenHub endpoints. ]]>