T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:140
- Finding
- Unpinned Third-Party Package Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, line 140 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash npx -y scholar-sidekick-mcp@latest # needs RAPIDAPI_KEY in env ``` ### Technical Analysis The optional MCP setup instructs users to download and immediately execute the mutable `@latest` release of the `scholar-sidekick-mcp` npm package. No exact version, lockfile, or package-integrity value is specified. The `-y` option also suppresses the normal installation confirmation. Because `@latest` can resolve to a different package release after the skill has been reviewed, the effective code being executed is not fixed by this repository. A compromised npm account, malicious package update, or upstream supply-chain compromise could therefore cause arbitrary package or lifecycle code to run locally. ### Attack Path 1. An attacker compromises the package publisher, npm package, or release process. 2. The attacker publishes a malicious version and assigns it the npm `latest` distribution tag. 3. A user follows the documented optional setup command. 4. `npx` resolves `scholar-sidekick-mcp@latest`, downloads the attacker-controlled release, and executes it without an interactive confirmation because of `-y`. 5. The malicious package executes with the privileges and environment available to the invoking process. ### Impact Assessment Successful exploitation permits arbitrary code execution with the invoking user or Agent process's privileges. The malicious package could read or modify files accessible to that account, initiate network connections, alter the working environment, or access environment variables available to the process. This may include the `RAPIDAPI_KEY` explicitly referenced by the setup instructions. The scope is limited by the operating-system privileges and isolation controls applied to the process.
- Remediation
- ## Remediation Suggestions - Replace `@latest` with an exact, reviewed package version; for example, use `scholar-sidekick-mcp@X.Y.Z` without a version range. - Commit and enforce a lockfile where installation is part of a managed project workflow. - Verify package provenance and integrity before execution, using npm registry integrity metadata, signed provenance, or an independently published checksum. - Remove `-y` so users receive an explicit confirmation before third-party code is downloaded and run. - Review the pinned release and its transitive dependencies, including npm lifecycle scripts. - Run the package in a sandbox or container with least privilege, restricted filesystem access, and limited network access. - Provide secrets only when required, scope the RapidAPI key narrowly, and avoid exposing it to installation or lifecycle scripts where possible. - Establish an explicit dependency-update process so newer versions are reviewed before the pinned version is changed.