T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Automatic Execution of an Unverified Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 12–16 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml Add the MCP server (local STDIO): command: npx args: ["-y", "@decionis/commerce@0.1.3"] env: DECIONIS_API_KEY (secret), DECIONIS_ORG_ID, DECIONIS_API_BASE (optional) ``` ### Technical Analysis The skill directs users to launch `@decionis/commerce@0.1.3` through `npx -y`. If the package is not already available locally, `npx` retrieves it from the configured npm registry and executes it. The `-y` option suppresses the normal installation confirmation. Pinning the version limits unexpected upgrades, but the project provides no reviewed local implementation, package-lock file, cryptographic integrity value, or package-provenance verification. Consequently, the effective executable code is outside the audited artifact and depends on the integrity of the npm account, registry, configured registry mirror, and published package version. The process is explicitly supplied with `DECIONIS_API_KEY` and `DECIONIS_ORG_ID`. Any malicious code executed by the package—including applicable installation lifecycle or runtime code—could read these environment variables and operate with the filesystem, network, and process privileges granted to the invoking user. ### Attack Path 1. An attacker compromises the package publisher account, registry infrastructure, configured registry mirror, or the contents associated with the referenced package version. 2. A user follows the setup instructions and launches `npx -y @decionis/commerce@0.1.3`. 3. `npx` retrieves and executes the external package without interactive installation approval. 4. Malicious lifecycle or runtime code reads `DECIONIS_API_KEY`, `DECIONIS_ORG_ID`, and other accessible process or host data. 5. The code transmits stolen data or performs unauthorized local and network operations using the invoking user's privileges. ### Impact As ...[truncated 625 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor and independently review the MCP server implementation before deployment rather than downloading executable code at invocation time. 2. Install dependencies during a controlled build step and commit a lockfile containing verified integrity metadata. 3. Verify npm provenance, publisher identity, package signatures where available, and registry configuration. 4. Remove automatic `-y` execution from end-user instructions and require explicit administrative approval for initial installation. 5. Disable npm lifecycle scripts where compatible with the package and deployment model. 6. Run the MCP server under a dedicated, unprivileged account or sandbox with read-only filesystem access and a strict network allowlist. 7. Supply only the required environment variables, and ensure unrelated credentials are absent from the process environment. 8. Use a narrowly scoped, short-lived API credential; rotate it regularly and immediately after suspected package or host compromise. 9. Monitor dependency advisories and verify package integrity before every approved update.