T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Unpinned Executable npm Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 12-20 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ```yaml { "id": "mcporter", "kind": "node", "package": "mcporter", "bins": ["mcporter"], "label": "Install mcporter CLI (npm)", }, ], }, ``` ### Technical Analysis The skill declares `mcporter` as an npm dependency without specifying an exact version or package integrity hash. Consequently, installation can resolve to a package release that differs from the version originally reviewed. Because the dependency provides a locally executed CLI, malicious package code, compromised future releases, or unsafe installation lifecycle scripts could execute with the privileges of the user installing the skill. This is a supply-chain weakness rather than evidence that the current `mcporter` package is malicious. Exploitation depends on compromise or malicious alteration of the upstream package or its distribution channel. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or another relevant distribution component. 2. The attacker publishes a malicious release under the expected package name. 3. A user installs the skill after that release becomes the version selected by npm. 4. Installation lifecycle code or the installed `mcporter` executable runs attacker-controlled code. 5. The code executes within the permissions and accessible environment of the installing user. ### Impact Assessment Successful exploitation could permit arbitrary local code execution with the installing user's privileges. Depending on that user's permissions, accessible scope could include project files, user-owned files, environment variables, application credentials, network access, and configuration data. The declaration itself does not request elevated operating-s ...[truncated 89 chars]
- Remediation
- ## Remediation Suggestions - Pin `mcporter` to an exact, reviewed version rather than resolving a mutable latest release. - Use an npm lockfile and verify the package integrity hash during installation. - Document the expected package publisher, registry, version, and provenance. - Review package contents and lifecycle scripts before approving upgrades. - Disable npm lifecycle scripts where operationally feasible. - Automate dependency vulnerability, provenance, and unexpected-maintainer-change checks. - Run the CLI with least privilege and avoid exposing unnecessary credentials or sensitive environment variables.