T08 · Insecure Dependencies
Warning
- Location
scripts/install-gate-mcp.sh:37- Finding
Unpinned Global npm Package Installation Enables Supply-Chain Code Execution
- Content
View full analysis
/dev/null; then echo -e "${YELLOW}⚠ mcporter is already installed ($(mcporter --version))${NC}" read -p "Do you want to reinstall/update? (y/N): " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then echo "Updating mcporter..." npm i -g mcporter fi else echo "Installing mcporter globally..." npm i -g mcporter fi ``` The same unsafe installation method is also recommended in `SKILL.md:31-33`: ```bash npm i -g mcporter # Or verify installation npx mcporter --version ``` ### Technical Analysis The installer retrieves `mcporter` from the configured npm registry without specifying a reviewed version or validating package integrity. Consequently, each installation or update resolves to whichever release the registry currently identifies as the default version. npm packages can define lifecycle hooks such as `preinstall`, `install`, and `postinstall`. These hooks normally execute automatically during installation with the permissions of the user running npm. Therefore, compromise of the package publisher, npm account, registry path, or a future package release could turn the installation command into an arbitrary local code-execution channel. The global installation flag (`-g`) increases the scope of filesystem changes by installing executable tooling into the user's or system's global npm prefix. If the script is run with elevated privileges, package lifecycle code may inherit those elevated privileges. The documented `npx mcporter --version` command is also unsafe when the package is absent because `npx` may retrieve and execute an unpinned package. This finding does not establish that the current `mcporter` package is malicious. The vulnerability is the absence of dependency version ...[truncated 1691 chars]- Remediation
View remediation