T08 · Insecure Dependencies
Error
- Location
- SKILL.md:172
- Finding
- Unpinned Third-Party MCP Packages Are Automatically Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 172-192 **Vulnerability Type**: Supply-chain exposure through unpinned packages and automatic `npx` installation **Risk Level**: High ### Vulnerable Code ```yaml mcpServers: travel-data: command: npx args: ["-y", "@travel/mcp-server"] env: TRAVEL_API_KEY: "${TRAVEL_API_KEY}" hotel-booking: command: npx args: ["-y", "@hotel/mcp-server"] env: HOTEL_API_KEY: "${HOTEL_API_KEY}" city-transport: command: npx args: ["-y", "@city-transport/mcp-server"] env: TRANSPORT_API_KEY: "${TRANSPORT_API_KEY}" ``` ### Technical Analysis The MCP configuration invokes three third-party npm packages through `npx -y`. The `-y` option suppresses installation confirmation, while the package references omit exact versions. No lockfile, integrity hash, vendored artifact, or explicitly trusted installation registry is supplied. Consequently, the code executed when the MCP servers start is not immutable and may differ from the code reviewed during this audit. The risk applies to: - `@travel/mcp-server` - `@hotel/mcp-server` - `@city-transport/mcp-server` If any package name, publisher account, registry resolution path, or later package release is compromised, arbitrary package lifecycle or server code could execute in the MCP process. Each process also receives a service-specific API key through its environment and is intended to process potentially sensitive travel, hotel, order, or location-related information. This finding does not establish that the named packages are currently malicious. It identifies an unsafe dependency execution pattern that permits an upstream compromise to become local code execution. ### Attack Path 1. An attacker compromises a package publisher, package release, or registry resolution path for one of the configured MCP packages. 2. The attacker publishes a malicious release under the same unversioned package name. 3. An Agent ...[truncated 1507 chars]
- Remediation
- ## Remediation Suggestions 1. Replace unversioned package references with exact, reviewed versions, for example `@scope/package@1.2.3`. Do not use version ranges or floating tags. 2. Install dependencies during a controlled build stage rather than downloading them automatically at runtime with `npx -y`. 3. Commit and enforce a lockfile, and use reproducible installation such as `npm ci`. 4. Verify package integrity through lockfile integrity metadata, trusted checksums, signatures, or an internal artifact repository containing approved packages. 5. Explicitly configure a trusted npm registry and prevent fallback to unintended public or private registries. 6. Review package provenance, ownership, release history, lifecycle scripts, transitive dependencies, and published contents before approval. 7. Disable npm lifecycle scripts where they are unnecessary, or separately inspect and permit required scripts. 8. Run every MCP server in an isolated container or sandbox with a read-only filesystem, restricted outbound networking, no access to unrelated host files, and a dedicated low-privilege operating-system identity. 9. Provide each process only its required credential and data. Do not expose unrelated environment variables or API keys. 10. Apply narrowly scoped API permissions, short-lived credentials, rotation, rate limits, and monitoring for anomalous use. 11. Establish a dependency update process requiring security review before any pinned package version is changed.