T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned Third-Party Package Is Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14-16` and `SKILL.md:20-33` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash npx -y @xferops/flower-mcp ``` The same unsafe dependency invocation is included in the persistent MCP client configuration: ```json { "mcpServers": { "flower": { "command": "npx", "args": ["-y", "@xferops/flower-mcp"], "env": { "FLOWER_URL": "https://flower.xferops.com", "FLOWER_TOKEN": "your-api-token" } } } } ``` ### Technical Analysis The instructions execute `@xferops/flower-mcp` without specifying an exact package version or integrity value. Consequently, `npx` resolves the package version through the npm registry at execution time. The `-y` option automatically approves package installation, removing an opportunity for the user to inspect and explicitly approve the resolved package. This pattern creates a supply-chain exposure because the code executed on a future invocation may differ from the code that was available when the Skill was reviewed. A malicious package release could result from compromise of the package maintainer account, npm publication credentials, the package itself, or one of its transitive dependencies. The MCP configuration makes the exposure more significant because the package is launched with `FLOWER_TOKEN` in its environment. Any code executed within the MCP server process can normally read that environment variable. It also runs with the filesystem and operating-system privileges of the user who launches the MCP client. There is no evidence in the audited file that the current package is malicious. The vulnerability is the unpinned, automatically approved dependency execution mechanism. ### Attack Path 1. An attacker compromises the npm package, its publication process, a maintainer account, or a transitive dependency. 2. The attacker publishes a malicious version that is com ...[truncated 1249 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version, for example: ```bash npx -y @xferops/flower-mcp@X.Y.Z ``` Apply the same exact version to the MCP configuration: ```json { "command": "npx", "args": ["-y", "@xferops/flower-mcp@X.Y.Z"] } ``` 2. Prefer a controlled installation process using a committed lockfile and npm integrity metadata rather than resolving and downloading the package whenever the MCP server starts. 3. Review package updates before changing the pinned version. Verify package ownership, provenance, signatures where available, published contents, and dependency changes. 4. Configure npm to use an explicitly trusted registry and prevent unintended registry overrides or dependency-confusion resolution. 5. Remove automatic approval with `-y` from interactive installation guidance where practical, allowing users to inspect the package and resolved version before installation. 6. Run the MCP server in a restricted environment with only the filesystem and network access required for Flower operations. 7. Use a narrowly scoped Flower token with the minimum required permissions. Rotate it regularly and immediately after any suspected dependency compromise. 8. Avoid exposing unrelated credentials to the MCP process. Ensure the process environment contains only the Flower configuration it requires. ]]>