T08 · Insecure Dependencies
- Location
scripts/ensure-links.sh:26- Finding
Unpinned npm Packages Are Downloaded and Executed
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ensure-links.sh:26, 61-71
Vulnerability Type: Unpinned third-party dependencies and runtime package execution
Risk Level: MediumComplete Code Snippet
bash local_mcp_command="${WEBMCP_LOCAL_MCP_COMMAND:-npx -y @webmcp-bridge/local-mcp}" daemon_idle_ttl="${WEBMCP_DAEMON_IDLE_TTL:-}" # ... read -r -a launcher_parts <<< "$local_mcp_command" link_args=("${launcher_parts[@]}" --url "$url" --headless --no-auto-login-fallback --user-data-dir "$profile") link_value="$(shell_join "${link_args[@]}")" link_install_args=(board-webmcp-cli "$link_value" --daemon-exclusive "$profile") if [[ -n "$daemon_idle_ttl" ]]; then link_install_args+=(--daemon-idle-ttl "$daemon_idle_ttl") fi link_install_args+=(--force) "${link_command[@]}" "${link_install_args[@]}" >/dev/nullRelated unpinned installation guidance also appears in
SKILL.md:14, 67-71:bash npx playwright installTechnical Analysis
The default launcher uses
npx -y @webmcp-bridge/local-mcpwithout an exact package version or integrity constraint. The-yoption permits package acquisition without an interactive confirmation. The generated command is then registered as the reusableboard-webmcp-clilink.Consequently, the package code executed by a later invocation can differ from the code available when the Skill was audited. A compromised package release, maintainer account, registry response, or dependency chain could introduce arbitrary code. The Playwright installation guidance likewise does not identify an audited version.
This is a supply-chain weakness rather than evidence that the current packages are malicious.
Attack Path
- An attacker compromises the npm package, its publisher account, or a transitive dependency and publishes a malicious release.
- The setup script registers an unversioned
npxlauncher for@webmcp-bridge/local-mcp. - A user or Agent invokes
board-webmcp-cli, causin ...[truncated 977 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin every executable npm dependency to an exact reviewed version, for example:
bash npx --yes @webmcp-bridge/local-mcp@X.Y.Z npx --yes playwright@X.Y.Z install -
Prefer installing dependencies through a checked-in lockfile with integrity hashes rather than resolving them dynamically during normal Skill operation.
-
Remove
npx -yfrom recurring execution paths. Install dependencies in a controlled setup phase and invoke a verified local binary afterward. -
Use a trusted registry and enforce package provenance or signature verification where supported.
-
Review and pin transitive dependencies, then automate vulnerability and integrity scanning for dependency updates.
-
Update
SKILL.mdso all installation commands specify the same audited versions used by the implementation.
-