T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:38
- Finding
- Unpinned npm Package Executes with a Financial API Secret## Vulnerability Details **File Location**: `SKILL.md`, lines 38–46 **Vulnerability Type**: Unpinned third-party dependency with access to sensitive credentials **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "satsrail": { "command": "npx", "args": ["-y", "satsrail-mcp"], "env": { "SATSRAIL_API_KEY": "sk_test_your_key_here" } } } } ``` ### Technical Analysis The configuration runs `npx -y satsrail-mcp` without specifying an exact package version or enforcing an integrity constraint. Consequently, npm resolves, downloads, and executes whichever package version is current at execution time. The `-y` option automatically accepts installation prompts, reducing the opportunity for users to review what will be installed. The launched package receives `SATSRAIL_API_KEY` in its process environment. The documentation explicitly allows test or live keys, so the exposed credential may authorize financial operations. This creates a supply-chain trust boundary: a compromised package release, publisher account, registry response, or transitive dependency could execute arbitrary code with access to the key. The reviewed project does not establish that the current `satsrail-mcp` package is malicious. The vulnerability is the unsafe, mutable dependency execution pattern combined with credential exposure. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry resolution path, or a dependency used by `satsrail-mcp`. 2. The attacker publishes or causes resolution to a malicious package version. 3. A user starts the configured MCP server. 4. `npx -y` automatically retrieves and executes the attacker-controlled version without an exact version or integrity check. 5. The malicious process reads `SATSRAIL_API_KEY` from its environment. 6. The attacker exfiltrates the credential or performs API operations within the key's permissions. ### Impact Assessment Success ...[truncated 550 chars]
- Remediation
- ## Remediation Suggestions - Pin `satsrail-mcp` to an exact, reviewed version rather than resolving the latest release dynamically. - Install the dependency through a committed lockfile and verify registry integrity metadata during installation. - Avoid automatic `npx -y` execution for software that receives sensitive credentials. Prefer a controlled, reviewed installation process. - Verify the npm package publisher, repository provenance, signatures or attestations where available, and the dependency tree before deployment. - Use a test key during initial configuration and validation. - Apply least privilege to production API keys, restricting them to only the operations required by the agent. - Run the MCP server in an isolated environment with minimal filesystem, network, and operating-system permissions. - Rotate the API key immediately if package or dependency integrity is uncertain, or if an untrusted version may have been executed. - Monitor API activity for unexpected orders, invoices, checkout sessions, wallet access, or other anomalous operations.