T08 · Insecure Dependencies
Warning
- Location
- scripts/setup_chrome_mcp.py:39
- Finding
- Unpinned npm Package Is Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup_chrome_mcp.py:39`, `scripts/setup_chrome_mcp.py:68-76`, `scripts/setup_chrome_mcp.py:124-128`; documented in `SKILL.md:36-53` and `SKILL.md:60-68` **Vulnerability Type**: Unpinned executable third-party dependency **Risk Level**: Medium ### Vulnerable Code The setup operation downloads and executes the mutable `latest` release: ```python # Pre-cache the package print("📦 Installing chrome-devtools-mcp...") code, out, err = run("npx -y chrome-devtools-mcp@latest --help", timeout=60) ``` The generated OpenClaw configuration also uses the mutable release: ```python config = { "mcp": { "servers": { "chrome-devtools": { "command": "npx", "args": ["-y", "chrome-devtools-mcp@latest", "--headless", "--no-usage-statistics"] } } } } ``` The test operation downloads and launches the same unpinned package: ```python proc = subprocess.Popen( ["npx", "-y", "chrome-devtools-mcp@latest", "--headless", "--no-usage-statistics"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True ) ``` The documentation instructs users to use the same pattern: ```bash npx -y chrome-devtools-mcp@latest --help ``` ```json { "mcp": { "servers": { "chrome-devtools": { "command": "npx", "args": ["-y", "chrome-devtools-mcp@latest", "--headless", "--no-usage-statistics"] } } } } ``` ### Technical Analysis The `latest` npm distribution tag is mutable and can resolve to a different package version each time the command runs. The `-y` option suppresses the interactive installation confirmation, while `npx` downloads and immediately executes the resolved package. Consequently, the effective code executed by this Skill is not fixed to the version that was reviewed. A future upstream release, compromised publisher account, registry compromise, or malicious supply-chain update could replace the re ...[truncated 1904 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `chrome-devtools-mcp@latest` with an exact, reviewed version in every command and generated configuration, for example: ```python CHROME_DEVTOOLS_MCP_VERSION = "x.y.z" package = f"chrome-devtools-mcp@{CHROME_DEVTOOLS_MCP_VERSION}" ``` 2. Do not use version ranges, mutable distribution tags, or implicit latest-version resolution. 3. Prefer a project-local installation governed by a committed lockfile rather than downloading the package whenever the server starts: ```bash npm install --save-exact chrome-devtools-mcp@x.y.z npm ci ``` 4. Commit and review `package.json` and `package-lock.json`, and use `npm ci` so dependency resolution follows the lockfile exactly. 5. Verify registry integrity metadata and package provenance where supported. Consider enforcing an approved registry and allowlisting the expected package and version. 6. Separate dependency installation from routine MCP startup. Startup should execute an already installed, verified binary and should not retrieve new executable code. 7. Remove `-y` from any workflow that can unexpectedly install a package, or require explicit administrative approval before downloading a new version. 8. Update `SKILL.md`, the setup operation, the test operation, and the generated OpenClaw configuration together so none of them continue recommending or executing `@latest`. 9. Establish an explicit upgrade process that includes source review, release-note review, integrity verification, and testing before changing the pinned version. ]]>