T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:50
- Finding
- Unpinned npm Package Execution Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:50`, `SKILL.md:77-80`, and `mcp.json:4-5` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ### Vulnerable Code `SKILL.md:50`: ```bash mcporter config add clawaimail "npx -y clawaimail-mcp" --env CLAWAIMAIL_API_KEY="pb_your_api_key" ``` `SKILL.md:75-82`: ```json { "mcpServers": { "clawaimail": { "command": "npx", "args": ["-y", "clawaimail-mcp"], "env": { "CLAWAIMAIL_API_KEY": "pb_your_api_key" } } } } ``` `mcp.json:2-9`: ```json { "mcpServers": { "clawaimail": { "command": "npx", "args": ["clawaimail-mcp"], "env": { "CLAWAIMAIL_API_KEY": "your_api_key_here" } } } } ``` ### Technical Analysis The recommended MCP configurations invoke `clawaimail-mcp` through `npx` without specifying an exact package version. The command in `SKILL.md:50` also uses `-y`, which suppresses the package installation confirmation prompt. Because package resolution is not pinned to the audited release, the code executed by a future invocation can differ from the code contained in this artifact. A later package version would be obtained from the npm registry and run locally under the privileges of the MCP host process. The MCP process receives `CLAWAIMAIL_API_KEY` in its environment. Therefore, any compromised or maliciously modified package release selected by `npx` could read that credential. It would also inherit the operating-system permissions and network access of the user running the MCP client. No evidence was found that the package or code currently included in the reviewed artifact is malicious. The vulnerability is the unsafe, mutable dependency execution mechanism. ### Attack Path 1. An attacker compromises the npm package publication account, registry resolution path, or upstream release process for `clawaimail-mcp`. 2. The attacker publishes a modified release under the ...[truncated 1264 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every documented and bundled invocation to an exact audited version: ```bash mcporter config add clawaimail "npx -y clawaimail-mcp@0.2.1" --env CLAWAIMAIL_API_KEY="pb_your_api_key" ``` ```json { "mcpServers": { "clawaimail": { "command": "npx", "args": ["-y", "clawaimail-mcp@0.2.1"], "env": { "CLAWAIMAIL_API_KEY": "pb_your_api_key" } } } } ``` 2. Prefer installing dependencies from a reviewed lockfile with integrity metadata, then execute the locally installed binary rather than resolving a package dynamically at every launch. 3. Update package versions only through a controlled review process that verifies source changes, npm provenance, package contents, and integrity hashes. 4. Run the MCP server under a dedicated, least-privileged account or sandbox with access only to required network destinations and files. 5. Provide the API key through the MCP client's secret-management facility where available, and use a narrowly scoped, revocable credential. 6. Align the inconsistent project versions before release: `SKILL.md` and `_meta.json` report `0.2.7`, executable/package metadata reports `0.2.1`, and `package-lock.json` reports `0.1.0`. Regenerate the lockfile so users can reliably identify and install the reviewed artifact. ]]>