T08 · Insecure Dependencies
Error
- Location
- references/core/mcp-servers.md:14
- Finding
- Unpinned Third-Party MCP Packages Are Downloaded and Executed Automatically## Vulnerability Details **File Location**: `references/core/mcp-servers.md`, lines 14-110 **Vulnerability Type**: Unpinned and unverified third-party dependency execution **Risk Level**: High ### Vulnerable Configuration ```json "coingecko": { "command": "npx", "args": ["-y", "mcp-remote", "https://mcp.api.coingecko.com/mcp"] } ``` ```json "coingecko": { "command": "npx", "args": ["-y", "@coingecko/coingecko-mcp"], "env": { "COINGECKO_DEMO_API_KEY": "your-demo-key-here" } } ``` ```json "coinmarketcap": { "command": "npx", "args": ["-y", "@shinzolabs/coinmarketcap-mcp"], "env": { "COINMARKETCAP_API_KEY": "your-key-here", "SUBSCRIPTION_LEVEL": "Basic" } } ``` ```json "defillama": { "command": "npx", "args": ["-y", "@iqai/defillama-mcp"] } ``` ```json "dune": { "command": "npx", "args": ["-y", "dune-mcp-server"], "env": { "DUNE_API_KEY": "your-key-here" } } ``` ```json "exa": { "command": "npx", "args": ["-y", "mcp-remote", "https://mcp.exa.ai/mcp?exaApiKey=your-key-here"] } ``` ```json "exa": { "command": "npx", "args": ["-y", "exa-mcp-server"], "env": { "EXA_API_KEY": "your-key-here" } } ``` ### Technical Analysis The MCP installation examples invoke `npx` with the `-y` option and package names that do not specify exact versions. `npx` can retrieve the currently resolved package from the configured npm registry and immediately execute its entry point. The `-y` option suppresses the normal installation confirmation. Consequently, the code executed at installation or startup is not fixed to the content reviewed with this Skill. A compromised package release, maintainer account, transitive dependency, registry response, or mutable package tag could cause different and malicious code to run. No package lockfile, integrity hash, signature verification, or sandbox policy i ...[truncated 1729 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every package to an exact reviewed version, for example `package-name@1.2.3`, rather than resolving the latest mutable release. 2. Remove `-y` so installation or first execution requires explicit user approval. 3. Install dependencies through a lockfile-based process and enforce npm integrity hashes. 4. Verify package ownership, provenance, release signatures, and official provider documentation before recommending a package. 5. Prefer locally installed, reviewed dependencies over downloading and executing packages during MCP startup. 6. Run each MCP server in a sandbox or container with: - Read-only filesystem access where possible. - Access only to explicitly required workspace paths. - A minimal environment containing only the required credential. - Network egress restricted to the intended provider endpoints. - No access to SSH keys, cloud credentials, wallet files, or unrelated configuration. 7. Document the trust boundary and require informed user consent before installing community-maintained servers. 8. Establish a dependency update process that reviews changes before updating pinned versions.