T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:198
- Finding
- Unpinned Remote npm Package Is Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 198–239; repeated at lines 260–284 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash npx -y ceaser-mcp shield 0.001 ``` ```bash npx -y ceaser-mcp notes ``` ```bash npx -y ceaser-mcp unshield <noteId> 0x742d35Cc6634C0532925a3b844Bc9e7595f2bD18 ``` ```bash npx -y ceaser-mcp import eyJzIjoiMTIzLi4uIn0= ``` ```bash npx -y ceaser-mcp help ``` The same unsafe dependency execution pattern is repeated in the transaction instructions: ```bash # Shield npx -y ceaser-mcp shield 0.001 # List notes to get noteId npx -y ceaser-mcp notes # Unshield npx -y ceaser-mcp unshield <noteId> <recipient> ``` It is also used when registering the package as an MCP server: ```bash claude mcp add --transport stdio ceaser -- npx -y ceaser-mcp ``` ### Technical Analysis The Skill directs the Agent to invoke `npx -y ceaser-mcp` without an exact package version or integrity constraint. If the package is not already present in the local npm cache, `npx` can retrieve the package from the configured npm registry and immediately execute it. The `-y` option suppresses the normal installation confirmation. Consequently, the effective executable payload is not fixed by the audited Skill files. It can change when a new package release is published, when registry resolution changes, or if the publisher account, package, registry, or local npm configuration is compromised. The risk is elevated because the package is expected to: - Generate zero-knowledge proofs. - Read and write privacy-note secrets. - Import note backup material. - Construct cryptocurrency transactions. - Select withdrawal recipients and submit settlement requests. - Run persistently as an MCP server with access to the Agent's tool environment. The package source and dependency tree are not included in the audited project, so their implementation and security properties could not be verified. ...[truncated 1762 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the package to an exact, reviewed version: ```bash npx --yes ceaser-mcp@<audited-exact-version> shield 0.001 ``` Do not use version ranges or tags such as `latest`. 2. Verify package integrity using a lockfile, an approved npm cache, or an artifact whose cryptographic digest is validated before execution. 3. Prefer vendoring the reviewed package and its locked dependency tree into a controlled distribution instead of downloading executable code at invocation time. 4. Audit the package source, install scripts, transitive dependencies, proof-generation behavior, note-storage behavior, recipient handling, and network destinations before approval. 5. Remove automatic `-y` installation where feasible. Require explicit user approval before downloading or installing executable dependencies. 6. Separate dependency installation from financial operations. Installation should occur during a controlled setup phase, not while processing a shield or unshield request. 7. Run the package in a restricted environment with: - Minimal filesystem access. - No unrelated credentials in environment variables. - Network egress limited to required, verified endpoints. - A dedicated low-privilege operating-system account or sandbox. 8. Require explicit confirmation that displays the chain, contract, amount, fees, destination address, and transaction data before every financial operation. 9. Pin and verify the command used for MCP registration as well as the CLI commands. Do not register an unversioned package as a trusted MCP server. ]]>