T08 · Insecure Dependencies
Warning
- Location
- README.md:22
- Finding
- Unpinned Third-Party Package Is Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `README.md:22-28` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "vocab-voyage": { "command": "npx", "args": ["-y", "mcp-remote", "https://gponcrussdahcdyrlhcr.supabase.co/functions/v1/mcp-server"] } } } ``` ### Technical Analysis The recommended configuration invokes `npx` with `-y` and an unversioned `mcp-remote` package name. This causes the package manager to resolve, download, and execute the version currently available through the configured package registry without requiring interactive confirmation. Because neither an exact version nor an integrity constraint is specified, the code executed by this configuration can change after the Skill has been audited. The risk arises from the mutable third-party package supply chain rather than from malicious code found directly in this repository. The remote MCP connection itself is consistent with the Skill's declared functionality. However, dynamically obtaining an unpinned local executable is not the minimum-risk method for establishing that connection. ### Attack Path 1. An attacker compromises the `mcp-remote` package, one of its transitive dependencies, its publisher account, or the package resolution infrastructure. 2. The attacker publishes a malicious version that remains compatible enough to be selected by `npx`. 3. A user installs the documented configuration and starts the MCP integration. 4. `npx -y mcp-remote` downloads the currently resolved package without prompting the user. 5. The malicious package executes locally with the privileges of the user running the MCP host. 6. The package can inspect files, environment variables, MCP configuration, or credentials accessible to that user before optionally continuing normal proxy behavior to avoid detection. ### Impact Assessment Successful exploitation provides local code executio ...[truncated 593 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `mcp-remote` to a reviewed exact version: ```json { "command": "npx", "args": [ "-y", "mcp-remote@<audited-exact-version>", "https://gponcrussdahcdyrlhcr.supabase.co/functions/v1/mcp-server" ] } ``` 2. Where supported, install dependencies through a lockfile that records resolved versions and integrity hashes. 3. Verify the package publisher, provenance attestations, and registry signatures before recommending the package. 4. Document a controlled update process so the pinned version is changed only after security review. 5. Prefer a host's native remote MCP transport when available, eliminating the need to execute a locally downloaded proxy package. 6. Run the MCP proxy with a restricted environment and only the credentials required for this service. ]]>