T08 · Insecure Dependencies
- Location
README.md:35- Finding
Inconsistent and Unpinned npm Package Execution
- Content
View full analysis
Vulnerability Details
File Location:
README.md:35-39
Vulnerability Type: Supply-chain package confusion and unpinned runtime dependency execution
Risk Level: HighVulnerable Code Snippet
json { "mcpServers": { "deal-works": { "command": "npx", "args": ["@goettelman/deal-works-mcp"], "env": { "DEAL_WORKS_API_KEY": "your_api_key_here" } } } }The package identity declared by the project differs from the package invoked above:
json { "name": "@swgoettelman/deal-works-mcp", "version": "0.1.0" }The inconsistency also appears in the Cursor/VS Code example at
README.md:49-56and the usage comment atsrc/index.ts:6-11. In contrast,README.md:8,README.md:14, andSKILL.md:17-21identify the package as@swgoettelman/deal-works-mcp.Technical Analysis
The project declares and initially documents
@swgoettelman/deal-works-mcp, but its MCP configuration examples invoke@goettelman/deal-works-mcp. These are distinct npm package scopes.The examples execute the inconsistent package through
npxwithout an exact version. If the package is not already installed locally,npxcan resolve, download, and immediately execute code from the npm registry. The resulting process is explicitly givenDEAL_WORKS_API_KEYthrough its environment.Consequently, a user following the documented MCP configuration may execute a different package from the one represented by this repository. Even if the intended package is selected, omitting an exact version allows future package releases to replace the reviewed code at execution time.
Attack Path
- A user copies the Claude Desktop or Cursor/VS Code configuration from
README.md. - The MCP host starts
npx @goettelman/deal-works-mcpwithout an exact version. - npm resolves the differently scoped package and may download its latest release.
- The MCP host su ...[truncated 1133 chars]
- A user copies the Claude Desktop or Cursor/VS Code configuration from
- Remediation
View remediation
Remediation Suggestions
- Select one verified npm identity and use it consistently across
package.json,README.md,SKILL.md, source comments, MCP examples, repository metadata, and generated artifacts. - Replace every
@goettelman/deal-works-mcpreference with the intended verified scope if@swgoettelman/deal-works-mcpis authoritative. - Pin an exact reviewed version in all execution examples, such as:
json { "command": "npx", "args": ["--yes", "@swgoettelman/deal-works-mcp@0.1.0"] } - Prefer installing the package into a lockfile-controlled project and invoking the local binary rather than downloading code at MCP startup.
- Commit and enforce a package lockfile with integrity hashes for production deployments.
- Verify npm package ownership, provenance attestations, signatures, and registry configuration before distribution.
- Use a narrowly scoped API key with minimum required permissions, transaction limits, and no unrelated account privileges.
- Rotate any API keys that were supplied to the inconsistent package command, and review account activity for unauthorized operations.
- Add an automated release check that rejects inconsistent package names and unpinned executable examples.
- Select one verified npm identity and use it consistently across