T08 · Insecure Dependencies
Error
- Location
- scripts/yunxiao-mcp.cjs:67
- Finding
- Unpinned Runtime Dependency Executes with Access to the Full Parent Environment## Vulnerability Details **File Location**: `scripts/yunxiao-mcp.cjs:67-70` **Vulnerability Type**: Unpinned runtime dependency execution and excessive environment inheritance **Risk Level**: High ### Vulnerable Code ```js const server = spawn('npx', ['-y', 'alibabacloud-devops-mcp-server'], { env: { ...process.env, YUNXIAO_ACCESS_TOKEN: ACCESS_TOKEN }, stdio: ['pipe', 'pipe', 'inherit'] }); ``` The same unpinned execution pattern is recommended in `SKILL.md:42-51`: ```json { "mcpServers": { "yunxiao": { "command": "npx", "args": ["-y", "alibabacloud-devops-mcp-server"], "env": { "YUNXIAO_ACCESS_TOKEN": "<your-token>" } } } } ``` ### Technical Analysis The CLI invokes `npx -y alibabacloud-devops-mcp-server` without specifying an exact package version. Because the package is not declared in `package.json`, no lockfile or package integrity record constrains the code executed at runtime. Depending on the local npm cache and registry state, `npx` can retrieve and execute a newer package release each time the Skill is invoked. This creates a supply-chain trust boundary in which the effective executable payload can change after the Skill has been reviewed. A registry compromise, maintainer account takeover, or malicious future release could therefore introduce arbitrary code without any modification to this repository. The spawned package also receives `{ ...process.env }`. Although access to `YUNXIAO_ACCESS_TOKEN` is necessary for the declared Yunxiao functionality, inheritance of the entire parent environment is broader than necessary. It may expose unrelated API keys, cloud credentials, CI tokens, proxy credentials, and other secrets available to the parent process. No evidence was found that the currently referenced package is malicious. The vulnerability is the unsafe, mutable dependency execution model and the unnecessaril ...[truncated 1645 chars]
- Remediation
- ## Remediation Suggestions 1. Add `alibabacloud-devops-mcp-server` to `package.json` using a reviewed, exact version rather than invoking an unconstrained registry version. 2. Commit the generated lockfile and use a deterministic installation method such as `npm ci`. 3. Invoke the locally installed binary instead of `npx -y`, preventing automatic runtime installation and version changes. 4. Review package integrity and provenance before upgrades. Apply dependency updates through an explicit review process. 5. Replace `{ ...process.env }` with an allowlisted environment containing only values required for operation, for example: ```js const server = spawn(localServerPath, [], { env: { PATH: process.env.PATH, YUNXIAO_ACCESS_TOKEN: ACCESS_TOKEN }, stdio: ['pipe', 'pipe', 'inherit'] }); ``` 6. Include additional variables only when they are demonstrably required, and document why each one is necessary. 7. Update the MCP configuration example in `SKILL.md` to reference a locally installed, pinned binary rather than an unversioned `npx -y` command. 8. Configure the Yunxiao token with the minimum API permissions needed by the Skill and rotate it immediately if dependency compromise is suspected.