T08 · Insecure Dependencies
Error
- Location
- skill.yaml:17
- Finding
- Automatic Execution of an Unpinned Remote npm Package## Vulnerability Details **File Location**: `skill.yaml`, lines 17–21 **Vulnerability Type**: Unpinned third-party dependency executed through `npx` **Risk Level**: High **Vulnerable Code**: ```yaml mcp: servers: - name: edge command: npx args: ["-y", "@edgedottrade/edge", "--api-key", "${API_KEY}"] repository: "https://github.com/edgetrade/edge" ``` ### Technical Analysis The Skill launches `@edgedottrade/edge` using `npx -y` without specifying an exact package version or verifying an integrity hash. As a result, npm can retrieve and execute whichever package version currently satisfies the implicit latest-version resolution. The `repository` metadata does not cryptographically bind the downloaded npm package to the referenced GitHub repository. It therefore does not ensure that the executed artifact matches reviewed source code. The `-y` option also suppresses the normal installation confirmation, allowing the package to be downloaded and run automatically. This creates a supply-chain trust boundary in which the effective executable can change after the Skill has been audited. A compromised npm publisher account, malicious package release, or registry compromise could introduce arbitrary code into subsequent executions. ### Attack Path 1. An attacker compromises the npm publisher account, package, or relevant registry distribution path for `@edgedottrade/edge`. 2. The attacker publishes a malicious version that becomes the version resolved by the unpinned `npx` invocation. 3. The Skill starts the MCP server using `npx -y @edgedottrade/edge`. 4. `npx` downloads and executes the malicious package without interactive confirmation. 5. The package runs with the MCP process's local privileges, receives the Edge API key as an argument, and has outbound network access. 6. The malicious process can steal credentials, access locally available resources, communicate with attacker-controlled infr ...[truncated 725 chars]
- Remediation
- ## Remediation Suggestions - Pin `@edgedottrade/edge` to a specific, security-reviewed version rather than relying on implicit latest-version resolution. - Verify the package with a lockfile and npm integrity metadata or a separately validated cryptographic digest. - Install the reviewed dependency during a controlled build or deployment stage instead of downloading it dynamically at runtime. - Remove `-y` where interactive approval is feasible, although confirmation alone is not a substitute for version and integrity pinning. - Verify that the npm package provenance corresponds to the stated source repository and reviewed commit. - Run the MCP server in a restricted sandbox with minimal filesystem, environment, process, and network access. - Restrict outbound traffic to explicitly required Edge service endpoints. - Apply an API key with the minimum required permissions and financial limits. - Establish dependency monitoring and a controlled process for reviewing and upgrading the pinned version.