T08 · Insecure Dependencies
- Location
SKILL.md:26- Finding
Unpinned Third-Party Packages Executed Through npx
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:26-27
Vulnerability Type:T08: Insecure Dependencies
Risk Level: MediumVulnerable configuration:
json "command": "npx", "args": ["-y", "@allourthings/mcp-server"],Additional affected examples (
SKILL.md:121-127):markdown AllOurThings also ships a standalone CLI (`@allourthings/cli`) for scripting and automation outside of an AI session: ```bash npx @allourthings/cli list npx @allourthings/cli search "bosch" npx @allourthings/cli add --name "Dyson V15" --category "Appliances"text ### Technical Analysis The MCP configuration invokes `npx` with an unversioned npm package name. If the package is unavailable locally, `npx` may retrieve the package from the configured npm registry and execute its package-controlled code. Because no exact version or integrity value is specified, the code ultimately executed can change after the Skill has been reviewed. The `-y` option suppresses the installation confirmation for the MCP package, making this behavior automatic. The documented CLI commands likewise execute an unpinned version, although they do not include `-y`. Exploitation depends on compromise or malicious control of the package release, maintainer account, registry resolution, or transitive dependency chain. The supplied project contains only `SKILL.md`; the external package implementations and their transitive dependencies were not available for inspection. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or a dependency resolved by a future package release. 2. The attacker publishes a malicious release under `@allourthings/mcp-server` or `@allourthings/cli`. 3. The MCP configuration launches: ```bash npx -y @allourthings/mcp-server ``` Alternatively, a user runs one of the documented unversioned CLI commands. 4. `npx` resolves and downloads the current registry ...[truncated 1095 chars]- Remediation
View remediation
Remediation Suggestions
-
Pin every executable npm package to an exact reviewed version, for example:
json "command": "npx", "args": ["--yes", "@allourthings/mcp-server@X.Y.Z"]Replace
X.Y.Zwith a verified release and update it only through a controlled review process. -
Pin the CLI examples similarly:
bash npx @allourthings/cli@X.Y.Z list npx @allourthings/cli@X.Y.Z search "bosch" npx @allourthings/cli@X.Y.Z add --name "Dyson V15" --category "Appliances" -
Prefer a preinstalled dependency managed through a lockfile and a reproducible installation workflow. Commit the lockfile and use immutable or frozen-lockfile installation modes.
-
Verify package provenance, signatures or attestations where supported, and registry integrity metadata before approving upgrades. Review relevant transitive dependency changes.
-
Avoid automatic confirmation through
-ywhen interactive approval is practical. If unattended operation is required, combine exact version pinning with an approved package cache or internal registry. -
Run the MCP process with least privilege and sandbox it where possible. Restrict filesystem access to the intended vault directory and limit unnecessary environment variables and network access.
-
Establish dependency monitoring and a controlled upgrade process so security fixes can be adopted without automatically accepting unreviewed releases.
-