T08 · Insecure Dependencies
- Location
references/core/mcp-servers.md:14- Finding
Unpinned Third-Party MCP Packages Are Downloaded and Executed Automatically
- Content
View full analysis
Vulnerability Details
File Location:
references/core/mcp-servers.md, lines 14-110
Vulnerability Type: Unpinned and unverified third-party dependency execution
Risk Level: HighVulnerable Configuration
json "coingecko": { "command": "npx", "args": ["-y", "mcp-remote", "https://mcp.api.coingecko.com/mcp"] }json "coingecko": { "command": "npx", "args": ["-y", "@coingecko/coingecko-mcp"], "env": { "COINGECKO_DEMO_API_KEY": "your-demo-key-here" } }json "coinmarketcap": { "command": "npx", "args": ["-y", "@shinzolabs/coinmarketcap-mcp"], "env": { "COINMARKETCAP_API_KEY": "your-key-here", "SUBSCRIPTION_LEVEL": "Basic" } }json "defillama": { "command": "npx", "args": ["-y", "@iqai/defillama-mcp"] }json "dune": { "command": "npx", "args": ["-y", "dune-mcp-server"], "env": { "DUNE_API_KEY": "your-key-here" } }json "exa": { "command": "npx", "args": ["-y", "mcp-remote", "https://mcp.exa.ai/mcp?exaApiKey=your-key-here"] }json "exa": { "command": "npx", "args": ["-y", "exa-mcp-server"], "env": { "EXA_API_KEY": "your-key-here" } }Technical Analysis
The MCP installation examples invoke
npxwith the-yoption and package names that do not specify exact versions.npxcan retrieve the currently resolved package from the configured npm registry and immediately execute its entry point. The-yoption suppresses the normal installation confirmation.Consequently, the code executed at installation or startup is not fixed to the content reviewed with this Skill. A compromised package release, maintainer account, transitive dependency, registry response, or mutable package tag could cause different and malicious code to run. No package lockfile, integrity hash, signature verification, or sandbox policy i ...[truncated 1729 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin every package to an exact reviewed version, for example
package-name@1.2.3, rather than resolving the latest mutable release. - Remove
-yso installation or first execution requires explicit user approval. - Install dependencies through a lockfile-based process and enforce npm integrity hashes.
- Verify package ownership, provenance, release signatures, and official provider documentation before recommending a package.
- Prefer locally installed, reviewed dependencies over downloading and executing packages during MCP startup.
- Run each MCP server in a sandbox or container with:
- Read-only filesystem access where possible.
- Access only to explicitly required workspace paths.
- A minimal environment containing only the required credential.
- Network egress restricted to the intended provider endpoints.
- No access to SSH keys, cloud credentials, wallet files, or unrelated configuration.
- Document the trust boundary and require informed user consent before installing community-maintained servers.
- Establish a dependency update process that reviews changes before updating pinned versions.
- Pin every package to an exact reviewed version, for example