T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:26
- Finding
- Unpinned Third-Party Package Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 26 **Vulnerability Type**: Unpinned and mutable third-party dependency execution **Risk Level**: Medium ```bash claude mcp add domainforagents -- npx @domainforagents/mcp ``` ### Technical Analysis The documented installation command invokes `@domainforagents/mcp` through `npx` without specifying an exact package version or integrity digest. Consequently, the command can download and execute whichever package version the configured registry currently resolves. This creates a supply-chain exposure because the code executed at installation time may differ from the version originally reviewed. If the package publisher account, package release pipeline, or package registry is compromised, a malicious release could be delivered through the documented command. The MCP server is especially security-sensitive because it may receive the `DOMAINFORAGENTS_API_KEY`, interact with external services, and execute with the local user's operating-system privileges. The audited file does not establish that the referenced package is currently malicious. The vulnerability is the unsafe reliance on a mutable, unverified dependency. ### Attack Path 1. An attacker compromises the package publisher account, release pipeline, or registry entry associated with `@domainforagents/mcp`. 2. The attacker publishes a malicious package version under the legitimate package name. 3. A user follows the documented command without specifying a previously reviewed version. 4. `npx` resolves, downloads, and executes the attacker-controlled release. 5. The malicious package runs with the invoking user's privileges and may read accessible environment variables, including `DOMAINFORAGENTS_API_KEY`. 6. Using the stolen credential or active MCP integration, the attacker may perform operations allowed by the associated DomainForAgents account, potentially including domain registration, DNS modification, and access to account or ...[truncated 788 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version instead of allowing implicit latest-version resolution: ```bash claude mcp add domainforagents -- npx --yes @domainforagents/mcp@X.Y.Z ``` 2. Verify the selected release's provenance, publisher identity, repository, release history, and package contents before recommending it. 3. Record and validate an expected package integrity hash where the installation workflow supports integrity enforcement. 4. Prefer a lockfile-backed or preinstalled dependency workflow so dependency resolution is reproducible and reviewable. 5. Monitor the package for ownership changes, unexpected releases, compromised maintainers, and security advisories. 6. Run the MCP server in a restricted environment with only the filesystem, environment-variable, and network access required for its documented purpose. 7. Provide a narrowly scoped API key where supported, store it in a secrets manager rather than broadly exposing it in the process environment, and rotate it if package compromise is suspected. 8. Require explicit user confirmation before financially consequential or externally disruptive operations such as domain registration, renewal, or DNS modification. ]]>