T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned npm Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, line 17 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium **Complete Code Snippet**: ```sh npx -y @benchboss/mcp-client ``` ### Technical Analysis The Skill instructs users to run an npm package without specifying an exact version. The `npx` command resolves the package through the configured npm registry, downloads it if necessary, and executes its entry point. The `-y` option automatically accepts the installation prompt. No lockfile, package integrity hash, signature verification procedure, fixed source revision, or other reproducible dependency constraint is supplied. Consequently, the code executed at installation time can differ from the code that existed when this Skill was reviewed. Describing the package as official does not technically constrain dependency resolution or mitigate compromise of the package publisher, registry account, or release process. The external npm package was not included in the audited project and therefore its implementation could not be inspected. This finding concerns the unsafe, unpinned execution mechanism; it does not assert that the current package release is malicious. ### Attack Path 1. An attacker compromises the npm publisher account, package release pipeline, or another component capable of controlling the version resolved for `@benchboss/mcp-client`. 2. The attacker publishes a malicious release that becomes the version selected by the unpinned package reference. 3. A user follows the installation instruction in `SKILL.md`. 4. `npx -y` downloads the attacker-controlled release and executes it locally without an interactive installation confirmation. 5. The malicious package executes with the privileges of the user running the MCP host and can attempt to access user-readable files, environment variables, locally managed application material, and network resources. ### Impact Assessment Success ...[truncated 667 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the client to an exact reviewed version, for example `@benchboss/mcp-client@X.Y.Z`, rather than relying on the registry's currently resolved release. 2. Provide a lockfile with integrity metadata and use a reproducible installation process such as `npm ci`. 3. Document the verified npm publisher and canonical source repository so users can confirm package provenance. 4. Publish and verify cryptographic checksums, release signatures, or package attestations where supported. 5. Avoid `-y` for first-time installation when practical, allowing users to review the resolved package and version before execution. 6. Review package updates before changing the pinned version, including transitive dependency and lifecycle-script changes. 7. Run the MCP client with least privilege and restrict filesystem, secret, and network access to only what is required.