T08 · Insecure Dependencies
Error
- Location
- SKILL.md:100
- Finding
- Unpinned npm Package Executes with Access to a Funded Wallet Private Key## Vulnerability Details **File Location**: `SKILL.md`, lines 100-114 **Vulnerability Type**: Unpinned third-party dependency with sensitive credential access **Risk Level**: High ### Vulnerable Code ```json { "mcpServers": { "demandex": { "command": "npx", "args": ["-y", "demandex-mcp"], "env": { "EVM_PRIVATE_KEY": "0x…", "DEMANDEX_API_URL": "https://api.demandex.dev" } } } } ``` ```text `EVM_PRIVATE_KEY` (falls back to `PRIVATE_KEY`) funds the paid tools with USDC on Base. ``` ### Technical Analysis The documented configuration invokes `npx -y demandex-mcp` without specifying an exact package version or verifying package integrity. When the package is absent from the local npm cache, `npx` can retrieve the currently resolved package release from the npm registry and execute it automatically. The `-y` option suppresses the interactive installation confirmation. The executed package inherits the configured environment, including `EVM_PRIVATE_KEY` or its `PRIVATE_KEY` fallback. Consequently, any code executed through the package has direct access to a private key intended to control a USDC-funded wallet. A compromised maintainer account, malicious package release, registry compromise, or dependency-chain compromise could therefore turn the documented startup command into arbitrary remote code execution with wallet-key access. The audit did not establish that the current `demandex-mcp` package is malicious. The vulnerability is the unsafe trust and execution model: a mutable, unpinned dependency is automatically downloaded and executed while a high-value secret is present in its environment. ### Attack Path 1. An attacker compromises the `demandex-mcp` npm publishing account, the package itself, or one of its transitively executed dependencies. 2. The attacker publishes a malicious release under the same package name. 3. A user follows the documen ...[truncated 1453 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `demandex-mcp` to a reviewed, immutable version rather than resolving the latest release: ```json { "command": "npx", "args": ["-y", "demandex-mcp@0.3.0"] } ``` 2. Prefer installing from a lockfile-controlled project using `npm ci`, with the package and all transitive dependencies represented in a committed lockfile. 3. Verify package provenance, publisher identity, signatures or attestations, and integrity hashes before execution. Review each package update before changing the pinned version. 4. Do not provide a general-purpose or high-value wallet private key. Create a dedicated signer containing only the minimum USDC balance required for expected calls. 5. Apply wallet-level spending limits, monitoring, alerts, and periodic key rotation where the signing architecture permits them. 6. Run the MCP package in an isolated container or sandbox with a read-only filesystem, restricted outbound networking, no access to unrelated user files, and no unnecessary environment variables. 7. Prefer a constrained signing service or delegated/session key over exposing a raw private key directly to the npm process. 8. Document the exact reviewed package version and update procedure so users do not silently execute newly published code. 9. Remove the `PRIVATE_KEY` fallback where possible to prevent accidental use of an unrelated, more privileged wallet key.