T08 · Insecure Dependencies
Error
- Location
- SKILL.md:28
- Finding
- Unpinned Third-Party npm Package Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15-18 and 28-33 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```yaml install: - kind: node package: b402-mcp bins: [b402-mcp] ``` ```markdown ## Install ```bash npx b402-mcp@latest --claude ``` This generates a wallet at `~/.b402/wallet.json`, patches your Claude Desktop config, and registers the MCP server. Fund the wallet with USDC on Base to start. ``` ### Technical Analysis The documented command uses `npx b402-mcp@latest --claude`, which downloads and executes the release currently associated with the npm `latest` tag. The package is not pinned to a reviewed version or integrity hash. The installation metadata similarly names `b402-mcp` without a fixed version. As a result, the code executed by users can change after this skill has been reviewed. The external package implementation is not included in the audited project, so its behavior cannot be verified from the available artifact. The documented package capabilities make this supply-chain exposure security-sensitive. It reportedly creates a cryptocurrency wallet, modifies Claude Desktop configuration, registers an MCP server, and operates in an environment requiring `WORKER_PRIVATE_KEY`. A compromised publisher account, malicious package release, or unexpected upstream change could therefore execute arbitrary code in a context involving wallet credentials and asset-moving operations. No evidence in `SKILL.md` proves that the current npm package is malicious. The confirmed issue is the unsafe, unpinned execution mechanism and the resulting inability to guarantee that future installations execute the reviewed implementation. ### Attack Path 1. An attacker compromises the `b402-mcp` npm publisher account, package, or release process. 2. The attacker publishes a malicious version and assigns it to the `latest` distribution tag. 3. A user follows the skil ...[truncated 1616 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version: ```bash npx b402-mcp@0.4.2 --claude ``` The selected version must correspond to a version that has actually undergone security review; the example version should not be adopted without verification. 2. Pin the exact package version in the skill installation metadata rather than relying on a floating release or default npm resolution. 3. Install through a lockfile-controlled workflow and verify npm registry integrity metadata. For security-critical deployments, validate the package tarball checksum against a separately published, trusted checksum. 4. Review the source code and lifecycle scripts of the exact `b402-mcp` release before execution. Disable unnecessary npm lifecycle scripts where the package supports installation without them. 5. Avoid exposing `WORKER_PRIVATE_KEY` to installation or configuration steps. Provide the secret only to the minimal runtime component that requires signing authority. 6. Store wallet files with restrictive filesystem permissions and avoid plaintext private-key storage where a hardware-backed or isolated signer can be used. 7. Require explicit user confirmation for wallet creation, configuration changes, signing requests, and every operation that moves assets. 8. Run the MCP server under a dedicated, least-privileged account or sandbox with narrowly scoped filesystem, network, environment-variable, and wallet access. 9. Display and validate all transaction parameters—including chain, token, amount, destination, and contract—before signing. 10. Document the reviewed package version and update process so that upgrades require a new security review instead of automatically following the `latest` tag. ]]>