T08 · Insecure Dependencies
Warning
- Location
- INSTALL.md:37
- Finding
- Unpinned Global Installation of a Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `INSTALL.md`, lines 37–46 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```bash # macOS / Linux command -v mcporter || npm install -g mcporter ``` ```bat :: Windows — use cmd to install where mcporter 2>nul || npm install -g mcporter ``` The Skill metadata also declares the same package without a version constraint: ```yaml "requires": { "bins": ["mcporter"] }, "install": [ { "id": "node", "kind": "node", "package": "mcporter", "bins": ["mcporter"], "label": "Install mcporter (node)", }, ], ``` ### Technical Analysis The installation instructions retrieve and globally install the latest version of the `mcporter` npm package without an exact version, lockfile, integrity hash, signature verification, or documented publisher validation. Because npm dependencies may execute lifecycle scripts during installation, the effective code executed on a user's system can change after this Skill has been reviewed. A compromised package release, compromised maintainer account, registry substitution, or unexpected future release could introduce arbitrary code into the installation process. The global `-g` installation increases the affected scope because the resulting command becomes available across projects for the installing user. The audit did not establish that the current package is malicious; the vulnerability is the absence of controls ensuring that the reviewed dependency is the dependency subsequently installed. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or its dependency chain. 2. The attacker publishes a malicious package version or introduces a malicious lifecycle script. 3. A user follows the documented installation procedure without already having `mcporter`. 4. `npm install -g mcporter` resolves the attacker-controlled or otherwise unreviewed cu ...[truncated 961 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `mcporter` to a reviewed exact version rather than resolving the latest release: ```bash npm install -g mcporter@<reviewed-exact-version> ``` 2. Publish the expected package name, version, publisher identity, and integrity hash in the installation documentation. 3. Verify package provenance and signatures where supported by the distribution mechanism. 4. Prefer a project-local dependency with a committed lockfile over a global installation. 5. Disable npm lifecycle scripts during installation where compatible: ```bash npm install --ignore-scripts --save-exact mcporter@<reviewed-exact-version> ``` 6. Review the pinned package and its transitive dependencies before distribution. 7. Add automated dependency monitoring, but require review before updating the pinned version. 8. Update the Skill metadata so its automated installer uses the same exact reviewed version. ]]>