T08 · Insecure Dependencies
Warning
- Location
- references/setup.md:15
- Finding
- Unpinned Third-Party Packages Can Execute Unreviewed Code<![CDATA[ ## Vulnerability Details **File Location**: `references/setup.md`, lines 15–24 **Vulnerability Type**: Unpinned executable dependencies **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "ScraperAPI": { "command": "npx", "args": ["mcp-remote", "https://mcp.scraperapi.com/mcp", "--header", "Authorization: Bearer ${SCRAPERAPI_API_KEY}"] } } } ``` ```text Python-based, installed via PyPI (`pip install scraperapi-mcp-server`). **Only the `scrape` tool is available.** Requires Python 3.11+. ``` ### Technical Analysis The documented installation paths resolve and execute third-party packages without pinning an exact version or verifying package integrity. Running `npx mcp-remote` may download and immediately execute the version currently published under that package name. Likewise, `pip install scraperapi-mcp-server` installs the package version selected by the package index at installation time. Consequently, the code executed by future users can differ from the code that existed when this Skill was audited. If an upstream package, maintainer account, distribution channel, or transitive dependency is compromised, following the documented setup can execute attacker-controlled code locally. The lack of hashes, lockfiles, or exact version constraints prevents users from reliably reproducing a reviewed dependency set. ### Attack Path 1. An attacker compromises the `mcp-remote` package, `scraperapi-mcp-server` package, a maintainer account, or a transitive dependency. 2. The attacker publishes a malicious release under the legitimate package name. 3. A user follows `references/setup.md` without specifying a reviewed version. 4. `npx` or pip resolves the malicious release from the package registry. 5. The package executes during installation or MCP server startup with the privileges of the Agent user. 6. The malicious code can access resources available to that user, potentially including project files and env ...[truncated 643 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin each dependency to an exact version that has been reviewed: - Use an explicitly versioned npm package reference. - Use `scraperapi-mcp-server==<reviewed-version>` for pip. 2. Commit lockfiles for any locally managed npm or Python environment. 3. Verify package integrity using registry checksums, pip hash checking, signed artifacts, or an internal artifact repository. 4. Install the verified npm dependency separately and start it with `npx --no-install` or an equivalent command that cannot fetch a new package at runtime. 5. Pin and audit transitive dependencies where feasible. 6. Document a controlled dependency-update process that includes source review, vulnerability scanning, and regression testing. 7. Run the MCP server under a restricted account or sandbox with access only to the files, environment variables, and network destinations required for its function. ]]>