T08 · Insecure Dependencies
Warning
- Location
- forge-setup/SKILL.md:12
- Finding
- Unpinned npm Package Execution## Vulnerability Details **File Location**: `forge-setup/SKILL.md`, lines 12–14 and 23–25 **Vulnerability Type**: Supply-chain exposure through an unpinned npm dependency **Risk Level**: Medium ### Vulnerable Code Installation command at lines 12–14: ```bash npx -y @xferops/forge-mcp ``` MCP client configuration at lines 23–25: ```json "command": "npx", "args": ["-y", "@xferops/forge-mcp"], "env": { ``` ### Technical Analysis The installation instructions and persistent MCP configuration execute `@xferops/forge-mcp` without specifying an exact package version or integrity constraint. Consequently, `npx` resolves a mutable package release from the npm registry. The `-y` option suppresses the installation confirmation. No evidence indicates that the named package or publisher is currently malicious. However, this configuration creates a supply-chain trust boundary in which the code executed during setup or MCP startup can change after the skill has been reviewed. A compromised npm publisher account, registry namespace, or future package release could introduce arbitrary code that would execute under the MCP client user's account. The configured process also receives `FORGE_TOKEN` in its environment. Therefore, a malicious package version could read and disclose that credential in addition to performing other actions available to the local user. ### Attack Path 1. An attacker compromises the npm publisher account, package publication process, or another relevant supply-chain component for `@xferops/forge-mcp`. 2. The attacker publishes a malicious version that becomes the version resolved by the unpinned package specification. 3. A user runs the documented `npx -y @xferops/forge-mcp` command, or the MCP client starts the configured command. 4. `npx` retrieves and executes the malicious release without an interactive confirmation. 5. The malicious package runs with the MCP client user's permissions. 6. It can read process environment variables, including ...[truncated 827 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the package to an exact, reviewed version in both locations: ```bash npx -y @xferops/forge-mcp@1.2.3 ``` ```json "command": "npx", "args": ["-y", "@xferops/forge-mcp@1.2.3"] ``` 2. Prefer installing the package through a committed lockfile and invoking the verified local binary rather than retrieving a mutable registry version during every startup. 3. Verify package integrity using npm lockfile integrity metadata and enforce package provenance or trusted-publisher controls in CI and deployment workflows. 4. Review and test new versions before updating the pin. Use an automated dependency-update process that requires security review and approval. 5. Restrict the Forge token to the minimum API permissions required by the MCP server, rotate it if package compromise is suspected, and avoid exposing unrelated secrets to the MCP process. 6. Where operationally feasible, run the MCP server in a sandbox or isolated account with limited filesystem, network, and environment-variable access.