T08 · Insecure Dependencies
- Location
SKILL.md:12- Finding
Unpinned Executable npm Dependency
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 12-20
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Mediumyaml { "id": "mcporter", "kind": "node", "package": "mcporter", "bins": ["mcporter"], "label": "Install mcporter CLI (npm)", }, ], },Technical Analysis
The skill declares
mcporteras an npm dependency without specifying an exact version or package integrity hash. Consequently, installation can resolve to a package release that differs from the version originally reviewed. Because the dependency provides a locally executed CLI, malicious package code, compromised future releases, or unsafe installation lifecycle scripts could execute with the privileges of the user installing the skill.This is a supply-chain weakness rather than evidence that the current
mcporterpackage is malicious. Exploitation depends on compromise or malicious alteration of the upstream package or its distribution channel.Attack Path
- An attacker compromises the npm package, its publisher account, or another relevant distribution component.
- The attacker publishes a malicious release under the expected package name.
- A user installs the skill after that release becomes the version selected by npm.
- Installation lifecycle code or the installed
mcporterexecutable runs attacker-controlled code. - The code executes within the permissions and accessible environment of the installing user.
Impact Assessment
Successful exploitation could permit arbitrary local code execution with the installing user's privileges. Depending on that user's permissions, accessible scope could include project files, user-owned files, environment variables, application credentials, network access, and configuration data. The declaration itself does not request elevated operating-s ...[truncated 89 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin
mcporterto an exact, reviewed version rather than resolving a mutable latest release. - Use an npm lockfile and verify the package integrity hash during installation.
- Document the expected package publisher, registry, version, and provenance.
- Review package contents and lifecycle scripts before approving upgrades.
- Disable npm lifecycle scripts where operationally feasible.
- Automate dependency vulnerability, provenance, and unexpected-maintainer-change checks.
- Run the CLI with least privilege and avoid exposing unnecessary credentials or sensitive environment variables.
- Pin