T08 · Insecure Dependencies
Error
- Location
- SKILL.md:94
- Finding
- Unpinned npm Package Is Downloaded and Executed as an MCP Server## Vulnerability Details **File Location**: `SKILL.md:94-113` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: High The documented installation commands register an npm package without an exact version or integrity constraint: ```bash # Zero-install via npx (downloads pre-built binary) claude mcp add --transport stdio lnc -- npx -y @lightninglabs/lightning-mcp-server # With environment variables for production claude mcp add --transport stdio \ --env LNC_MAILBOX_SERVER=mailbox.terminal.lightning.today:443 \ lnc -- npx -y @lightninglabs/lightning-mcp-server # For development/regtest claude mcp add --transport stdio \ --env LNC_MAILBOX_SERVER=localhost:11110 \ --env LNC_DEV_MODE=true \ --env LNC_INSECURE=true \ lnc -- npx -y @lightninglabs/lightning-mcp-server ``` ### Technical Analysis `npx -y` automatically downloads and executes the registry-selected version of `@lightninglabs/lightning-mcp-server` without prompting the user. No exact package version, lockfile, cryptographic integrity value, or signature verification is specified. Consequently, the effective code executed by Claude can change after this Skill has been reviewed. A compromised npm publisher account, malicious package update, registry compromise, or compromised transitive dependency could introduce arbitrary code. Because this command is registered as an MCP server, it may be executed repeatedly in later Claude Code sessions rather than only during initial setup. The package name uses a scoped namespace, which reduces ordinary dependency-confusion exposure, but it does not protect against publisher compromise, malicious releases, or unsafe transitive dependencies. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or a dependency used by the package. 2. The attacker publishes a malicious version under the same package name. 3. A user follows the docume ...[truncated 1168 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the package to a specific, audited version, for example: ```bash npx -y @lightninglabs/lightning-mcp-server@1.2.3 ``` 2. Use a committed lockfile and npm integrity metadata where installation is managed as part of a project. 3. Prefer distributing a signed release binary with published SHA-256 checksums. 4. Verify the binary checksum and release signature before adding it to the MCP configuration. 5. Avoid `npx -y` for security-sensitive software unless the artifact is pinned and independently verified. 6. Run the MCP process with minimal operating-system privileges and restrict its filesystem and network access. 7. Establish dependency scanning, reproducible builds, and release provenance such as SLSA attestations for the published artifact.