T08 · Insecure Dependencies
Warning
- Location
- scripts/install-gate-mcp.sh:37
- Finding
- Unpinned Global npm Package Installation Enables Supply-Chain Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install-gate-mcp.sh:37-44` **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```bash if command -v mcporter &> /dev/null; then echo -e "${YELLOW}⚠ mcporter is already installed ($(mcporter --version))${NC}" read -p "Do you want to reinstall/update? (y/N): " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then echo "Updating mcporter..." npm i -g mcporter fi else echo "Installing mcporter globally..." npm i -g mcporter fi ``` The same unsafe installation method is also recommended in `SKILL.md:31-33`: ```bash npm i -g mcporter # Or verify installation npx mcporter --version ``` ### Technical Analysis The installer retrieves `mcporter` from the configured npm registry without specifying a reviewed version or validating package integrity. Consequently, each installation or update resolves to whichever release the registry currently identifies as the default version. npm packages can define lifecycle hooks such as `preinstall`, `install`, and `postinstall`. These hooks normally execute automatically during installation with the permissions of the user running npm. Therefore, compromise of the package publisher, npm account, registry path, or a future package release could turn the installation command into an arbitrary local code-execution channel. The global installation flag (`-g`) increases the scope of filesystem changes by installing executable tooling into the user's or system's global npm prefix. If the script is run with elevated privileges, package lifecycle code may inherit those elevated privileges. The documented `npx mcporter --version` command is also unsafe when the package is absent because `npx` may retrieve and execute an unpinned package. This finding does not establish that the current `mcporter` package is malicious. The vulnerability is the absence of dependency version ...[truncated 1691 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `mcporter` to a specific, reviewed version rather than resolving the current registry default: ```bash MCPORTER_VERSION="REVIEWED_VERSION" npm install --global "mcporter@${MCPORTER_VERSION}" ``` 2. Prefer a project-local installation governed by a committed lockfile instead of modifying the global npm environment: ```bash npm install --save-exact mcporter@REVIEWED_VERSION npm ci ``` 3. Verify the package source, publisher, provenance, and expected integrity before installation. Where supported, require npm provenance attestations and compare package hashes against trusted values. 4. Review package lifecycle scripts before approving a release. If the package does not require lifecycle hooks, install with scripts disabled: ```bash npm install --global --ignore-scripts "mcporter@REVIEWED_VERSION" ``` This option should only be used after confirming that disabling scripts does not break legitimate installation behavior. 5. Replace the documentation's unpinned `npx mcporter --version` command with either an invocation of an already verified local binary or an explicitly pinned package version. Avoid allowing `npx` to download an unspecified release. 6. Do not advise users to run the installer with `sudo` or another elevated account. Explicitly document that installation should occur with the minimum necessary privileges. 7. Establish a controlled update process in which new versions are reviewed and tested before the pinned version is changed. ]]>