T08 · Insecure Dependencies
- Location
SKILL.md:44- Finding
Unpinned Third-Party npm Package Is Downloaded and Executed with Sensitive Credentials
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 44–50
Vulnerability Type: Unpinned dependency execution with access to sensitive credentials
Risk Level: HighVulnerable Code
json "LocalsBnb MCP": { "command": "npx", "args": ["--yes", "localsbnb-mcp-server"], "env": { "APP_SECRET": "<your APP_SECRET; do not commit it to Git>", "APP_ID": "<your APP_ID>" } }The associated package declaration is also not pinned to a specific version:
yaml install: - kind: node package: localsbnb-mcp-server bins: - localsbnb-mcpTechnical Analysis
The documented configuration invokes
npx --yes localsbnb-mcp-serverwithout an exact version or verified integrity digest. Depending on the local npm cache and resolution behavior,npxcan retrieve the currently resolved package release from the configured npm registry and execute its code automatically.The process is explicitly supplied with
APP_IDandAPP_SECRET. The package is expected to use these credentials to access room availability, pricing, guest orders, and operational data. Consequently, any code executed from the package has direct access to the credentials and to the permissions of the user running the MCP client.The audited project contains only
SKILL.md; it does not include the MCP server source, a lockfile, an integrity hash, or another locally reviewable artifact. Therefore, the document's assertion that the package only contacts the official LocalsBnb API cannot be independently verified from this project. This does not prove that the current npm package is malicious, but the unpinned automatic execution creates a material supply-chain exposure.Attack Path
- An attacker compromises the npm publisher account, package distribution process, registry resolution path, or a future package release.
- The attacker publishes altered code under `localsbnb-mcp ...[truncated 1358 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin the dependency to an exact, reviewed version, for example
localsbnb-mcp-server@1.0.1, rather than resolving the latest available release. - Use a lockfile and verify the package archive with a trusted integrity digest before execution.
- Avoid automatic
npx --yesretrieval in production. Install the reviewed artifact through a controlled deployment process and execute the locally installed binary. - Include or link to immutable, reviewable source corresponding to the pinned package release. Use signed releases and provenance verification where available.
- Run the MCP server in a sandbox or container with a read-only filesystem, minimal file access, no unnecessary host mounts, and restricted operating-system privileges.
- Enforce outbound network allowlisting so the process can communicate only with the required official API hosts and trusted package infrastructure during a separate installation phase.
- Grant
APP_IDandAPP_SECRETonly the minimum read permissions required for the intended tools. Use separate credentials per deployment and rotate them after suspected package compromise. - Prevent credentials from appearing in logs, shell history, chat transcripts, crash reports, or committed configuration files.
- Add dependency monitoring and require security review before adopting future package versions.
- Pin the dependency to an exact, reviewed version, for example