T08 · Insecure Dependencies
Error
- Location
- SKILL.md:53
- Finding
- Unpinned Global Dependency Receives a Funded Wallet Private Key<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:48-53` (installation command), with the sensitive credential configuration at `SKILL.md:88-99` **Vulnerability Type**: Unpinned privileged third-party dependency **Risk Level**: High ### Vulnerable Code ```markdown ## Quick Start ### 1. Install ```bash npm install -g drain-mcp ``` ``` The globally installed executable is subsequently given the wallet private key: ```markdown ### 4. Configure Your MCP Client Add to your MCP config (Cursor: `.cursor/mcp.json`, Claude Desktop: `claude_desktop_config.json`): ```json { "mcpServers": { "drain": { "command": "drain-mcp", "env": { "DRAIN_PRIVATE_KEY": "0x_your_private_key" } } } } ``` ``` ### Technical Analysis The installation command retrieves and globally installs the latest version of `drain-mcp` without pinning an exact version or verifying an integrity digest. A global npm installation can execute package lifecycle scripts with the installing user's permissions. After installation, the MCP client launches the package executable and supplies it with `DRAIN_PRIVATE_KEY`. This project contains only `SKILL.md`; it does not include the package implementation, a lockfile, integrity metadata, or reproducible-build information. Consequently, the audited artifact cannot verify the package's claimed key-handling and network behavior. A compromised maintainer account, malicious package release, registry compromise, or unexpected future release could change the executable after this Skill has been reviewed. ### Attack Path 1. An attacker compromises the `drain-mcp` npm publishing account, the package supply chain, or a future package release. 2. The attacker publishes a malicious version under the same package name. 3. A user follows the documented `npm install -g drain-mcp` command, which resolves to that version because no exact version or integrity value is specified. 4. Malicious npm lifecycle code may execu ...[truncated 1083 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the installation to a reviewed, exact package version rather than resolving the latest release: ```bash npm install --global --ignore-scripts drain-mcp@4.0.2 ``` Enable lifecycle scripts only if they are documented, necessary, and separately audited. 2. Publish and verify the expected npm package integrity digest and package provenance. Require signed releases and npm provenance attestations in the release process. 3. Prefer a project-local installation backed by a committed lockfile over a global installation. Use deterministic clean installation, such as `npm ci`, and reject lockfile or integrity mismatches. 4. Include the implementation source corresponding to the distributed package in the review scope. Establish reproducible builds so reviewers can verify that the npm artifact matches the published source and version tag. 5. Run the MCP server in a restricted environment with minimum filesystem and network access. Limit outbound connections to documented Polygon RPC, directory, and explicitly approved provider endpoints. 6. Continue requiring a dedicated low-value wallet, but treat this only as defense in depth. Do not reuse the wallet for unrelated assets or grant unlimited token allowances. 7. Where possible, replace direct raw-key exposure with an isolated signer or wallet service that enforces destination, token, chain, amount, and transaction-type policies. Require explicit user approval for on-chain transactions. ]]>