T08 · Insecure Dependencies
Error
- Location
- SKILL.md:108
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 108–117 **Vulnerability Type**: Supply-chain risk from unpinned remote package execution **Risk Level**: High **Vulnerable Code Snippet**: ```bash npx @open-fleet/mcp-server setup ``` The setup wizard auto-detects Claude Code, Cursor, and Windsurf and configures MCP automatically. **Direct npx invocation** (for custom configs): ```bash OPENFLEET_API_KEY=ofk_xxx npx -y @open-fleet/mcp-server ``` ### Technical Analysis The documented commands instruct users to resolve and execute `@open-fleet/mcp-server` from the npm registry without specifying an exact audited version or package integrity value. Consequently, the code executed at installation time can change after the Skill itself has been reviewed. The `-y` option automatically accepts installation prompts, reducing the opportunity for users to inspect the resolved package and version. The `setup` command is also documented as automatically changing MCP configurations for detected applications. An npm package executes with the invoking user's permissions and may inherit environment variables, including `OPENFLEET_API_KEY`. This finding does not establish that the current npm package is malicious. The vulnerability is the unsafe trust and execution model: a compromised maintainer account, malicious release, registry incident, or unexpected future package version could turn the documented command into an arbitrary-code execution path. ### Attack Path 1. An attacker compromises the npm publisher account, package source, release pipeline, or another component of the package distribution chain. 2. The attacker publishes a malicious version under the legitimate `@open-fleet/mcp-server` package name. 3. A user follows the Skill documentation and invokes the package without an exact version constraint. 4. `npx` resolves and downloads the attacker-controlled release; with `-y`, installation proceeds without a ...[truncated 837 chars]
- Remediation
- ## Remediation Suggestions - Pin the package to a specific, reviewed version, for example `@open-fleet/mcp-server@X.Y.Z`. - Commit and enforce a lockfile where the surrounding installation system supports one. - Verify package provenance and integrity using npm registry signatures, checksums, or an equivalent trusted mechanism. - Remove `-y` from security-sensitive setup instructions so that users can inspect the package and resolved version before execution. - Document every configuration file and setting that the setup wizard modifies. - Prefer manual, reviewable configuration over automatic client discovery and modification. - Execute the server in a sandbox or restricted service account with access only to necessary files and environment variables. - Use a scoped, short-lived OpenFleet credential rather than a broadly privileged, long-lived API key. - Establish a controlled upgrade process in which new package versions are reviewed and tested before being recommended.