T08 · Insecure Dependencies
Error
- Location
- SKILL.md:98
- Finding
- Unpinned npm Package Is Automatically Retrieved and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 98–103 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```bash npm install -g simmer-mcp ``` ```text This step is **optional**. The MCP config in Step 4 uses `npx -y simmer-mcp`, which fetches the package on first launch even without a global install. Installing globally just makes the first launch slightly faster (no fetch delay). If you skip Step 3, everything still works. If you do install it and get an EACCES permission error on Linux/macOS: do NOT `sudo npm install` (creates permission tangles later). Either fix npm's global directory permissions per npm's docs, or just skip the global install — the `npx -y simmer-mcp` form in the config works either way. ``` The unpinned invocation is subsequently embedded in runtime configurations throughout the document: ```json { "command": "npx", "args": ["-y", "simmer-mcp"], "env": { "SIMMER_API_KEY": "sk_live_..." } } ``` ### Technical Analysis The Skill repeatedly configures agent runtimes to execute `npx -y simmer-mcp` without specifying an exact package version or integrity hash. `npx` may download the package from the npm registry on first launch, while `-y` suppresses the normal installation confirmation. Consequently, the code executed by the runtime is not fixed to the code reviewed when this Skill was published. A compromised npm publisher account, malicious package release, registry compromise, or future compromised update could replace the effective payload. npm installation lifecycle scripts may also execute during retrieval. This risk is amplified because the package is launched with `SIMMER_API_KEY` in its environment and is intentionally granted market and trading capabilities. A malicious package would therefore receive the API key directly and would execute with the operating-system privileges of the agent runtime. The global installation alternative ...[truncated 1756 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact reviewed version, for example: ```bash npx --yes simmer-mcp@3.5.2 ``` Apply the same exact version to every JSON, YAML, TOML, and CLI example. 2. Prefer installing from a lockfile-controlled local project rather than resolving a package dynamically whenever the runtime starts. 3. Verify package integrity against a trusted digest or signed provenance before execution. Document the expected package owner, version, and checksum. 4. Disable or strictly control npm lifecycle scripts during installation where compatible with the package: ```bash npm install --ignore-scripts --save-exact simmer-mcp@3.5.2 ``` 5. Do not use `npx -y` as a persistent runtime command. Resolve and verify the package during an explicit installation phase, then execute a fixed local binary. 6. Run the MCP server in a restricted environment with only the required environment variables, filesystem access, and network destinations. Do not expose unrelated user or agent credentials. 7. Establish a deliberate update process that reviews and tests new versions before changing the pinned version. ]]>