T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned npm Packages Are Downloaded and Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-101`, `references/setup.md:17-83`, and `references/tapo-mcp-setup.md:156-161` **Vulnerability Type**: Unpinned executable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npx mcporter config add tapo http://<TAPO_MCP_IP> \ --transport http \ --header "Authorization=Bearer <YOUR_TOKEN>" \ --scope home npx mcporter list tapo --schema npx mcporter call tapo.list_devices ``` The MCP Inspector is also invoked without a version constraint: ```bash npx @modelcontextprotocol/inspector http://127.0.0.1:3000 npx @modelcontextprotocol/inspector \ --header "Authorization: Bearer $TAPO_MCP_API_KEY" \ http://127.0.0.1:3000 ``` ### Technical Analysis The documentation repeatedly instructs users to invoke `mcporter` and `@modelcontextprotocol/inspector` through `npx` without specifying reviewed versions. When the requested package is not already installed locally, `npx` can resolve it from the npm registry, download it, and execute its package code immediately. Because no exact version, lockfile, or integrity hash is specified, the effective code executed by these commands can change after this Skill has been audited. This creates a supply-chain trust boundary between the Skill and mutable registry content. A compromised maintainer account, malicious package release, or upstream package takeover could result in arbitrary code running under the invoking user's account. ### Attack Path 1. An attacker compromises an upstream npm package, its publisher account, or the package distribution process. 2. The attacker publishes a modified version of `mcporter` or `@modelcontextprotocol/inspector`. 3. A user follows the documented command without an explicit version. 4. `npx` resolves and downloads the modified package. 5. Package installation or runtime code executes with the user's privileges. 6. The malicious package can access files available to that user, including MCP ...[truncated 722 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every executable npm dependency to an exact reviewed version, for example: ```bash npx --yes mcporter@<REVIEWED_EXACT_VERSION> list tapo --schema npx --yes @modelcontextprotocol/inspector@<REVIEWED_EXACT_VERSION> \ http://127.0.0.1:3000 ``` 2. Prefer declaring dependencies in a package manifest and committing a lockfile rather than downloading packages during each invocation. 3. Use `npm ci` in a controlled installation step so dependency resolution follows the lockfile. 4. Validate registry provenance and package integrity. Where supported, verify signatures or attestations. 5. Disable automatic package installation during normal Skill operation and invoke only a previously installed, reviewed local binary. 6. Periodically update the pinned versions through an explicit review and testing process. ]]>