T08 · Insecure Dependencies
Error
- Location
- scripts/ensure-links.sh:42
- Finding
- Unpinned npm Packages Are Downloaded and Executed at Runtime## Vulnerability Details **File Location**: `scripts/ensure-links.sh:42`; related instructions at `SKILL.md:15-18` and `references/troubleshooting.md:123-130` **Vulnerability Type**: Unpinned dependency retrieval and execution **Risk Level**: High ### Vulnerable Code `scripts/ensure-links.sh:42`: ```bash local_mcp_command="${WEBMCP_LOCAL_MCP_COMMAND:-npx -y @webmcp-bridge/local-mcp}" ``` `SKILL.md:15-18`: ```markdown - `npx` is installed and available in `PATH`. - Network access is available for the target website. - On a fresh machine, or under an isolated `HOME`, install Playwright browsers first with `npx playwright install`. - For local repo development, you may replace the default `npx -y @webmcp-bridge/local-mcp` launcher with `WEBMCP_LOCAL_MCP_COMMAND='node packages/local-mcp/dist/cli.js'`. ``` `references/troubleshooting.md:123-130`: ```markdown ## Fresh machine or isolated HOME cannot start Chromium If `local-mcp` fails with an error that the Playwright browser executable does not exist, the current environment does not have Playwright browsers installed yet. Install them once in that environment: ```bash npx playwright install ``` ``` ### Technical Analysis The generated UXC link defaults to `npx -y @webmcp-bridge/local-mcp` without an exact package version or an integrity constraint. When the package is not already available in an applicable local cache or installation, `npx` can resolve it from the configured npm registry, download it, and execute its package entry point. The `-y` option suppresses the normal installation confirmation. The documented `npx playwright install` command presents a similar supply-chain risk because it does not identify an audited Playwright version. The effective code executed by these commands can therefore change after this Skill has been reviewed. This is an insecure dependency practice rather than evidence that the current upstream packages are mali ...[truncated 2380 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every executable npm dependency to an exact reviewed version, for example: ```bash npx -y @webmcp-bridge/local-mcp@X.Y.Z npx -y playwright@X.Y.Z install ``` 2. Prefer installing dependencies from a committed lockfile and invoking the verified local binary instead of downloading code during each bridge launch: ```bash npm ci --ignore-scripts ./node_modules/.bin/local-mcp ``` If lifecycle scripts are required, review them before allowing execution rather than disabling them permanently. 3. Commit and enforce a lockfile with integrity hashes. Run installation with lockfile-strict behavior, such as `npm ci`, so unexpected dependency resolution fails rather than silently updating packages. 4. Separate dependency installation from normal bridge execution. Installation should be an explicit, reviewable setup operation; invoking a generated UXC link should not implicitly retrieve new executable code. 5. Use a trusted registry configuration and package provenance verification. Where supported, verify npm provenance attestations, package signatures, checksums, and expected publisher identities. 6. Record the resolved package version in link output or metadata so operators can identify precisely which implementation is being executed. 7. Apply equivalent controls to third-party adapter modules: require explicit user approval, pin package versions, restrict allowed registries or paths, and avoid loading arbitrary mutable package specifiers. 8. Run the bridge under a least-privileged account or sandbox with narrowly scoped filesystem and network access, especially when its browser profile contains authenticated sessions.