T08 · Insecure Dependencies
Error
- Location
- SKILL.md:15
- Finding
- Execution of Mutable, Unpinned npm Packages## Vulnerability Details **File Location**: `SKILL.md:15-17`, `SKILL.md:46-50`, and `SKILL.md:78-82` **Vulnerability Type**: Unsafe third-party dependency execution **Risk Level**: High ### Vulnerable Code `SKILL.md:15-17`: ```json "command": "npx", "args": ["-y", "@basedagents/mcp@latest"] ``` `SKILL.md:46-50`: ```sh npm i -g basedagents basedagents register ``` `SKILL.md:78-82`: ```sh npx basedagents scan lodash npx basedagents scan @modelcontextprotocol/server-filesystem ``` ### Technical Analysis The skill configures `npx` to download and execute `@basedagents/mcp@latest` with the `-y` option, which suppresses the installation confirmation. The `latest` tag is mutable, so the package executed by future users may differ from the version available when the skill was audited. The documented global installation and scanning commands also reference `basedagents` without an exact version or integrity constraint. Consequently, npm resolves whichever release is current at execution time. A compromised maintainer account, malicious future release, or npm supply-chain compromise could therefore replace the reviewed behavior with attacker-controlled code. The global installation recommendation increases exposure by making the downloaded executable available throughout the user's environment. No evidence establishes that the currently published packages are malicious; the vulnerability is the absence of reproducible dependency pinning and integrity verification. ### Attack Path 1. An attacker compromises the relevant npm package, its publisher account, or the package publication pipeline. 2. The attacker publishes a malicious release and assigns it to `latest`, or otherwise causes the unversioned package name to resolve to the malicious release. 3. A user loads the MCP configuration or follows one of the documented installation or scanning commands. 4. `npx -y` downloads and executes the package withou ...[truncated 968 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@basedagents/mcp@latest` with an explicitly reviewed, immutable version, such as `@basedagents/mcp@1.2.3`. 2. Pin every documented `basedagents` invocation to an exact version rather than relying on npm's current resolution. 3. Remove `-y` so unexpected installations are not accepted automatically. 4. Use a committed lockfile and npm integrity metadata to make dependency resolution reproducible. 5. Prefer a project-local installation over `npm i -g`, and execute the pinned local binary through an npm script. 6. Review package source, lifecycle scripts, ownership changes, and release provenance before upgrading. 7. Where practical, vendor or mirror approved package artifacts and verify their cryptographic hashes before execution. 8. Run the MCP server with least privilege, restricted filesystem access, and constrained network access. 9. Keep the signing keypair outside directories accessible to package tooling and apply restrictive file permissions. 10. Establish an explicit dependency-update process that requires security review before changing pinned versions.