T08 · Insecure Dependencies
Error
- Location
- SKILL.md:133
- Finding
- Unpinned Third-Party Package Executes with Access to Authenticated Browser Sessions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 133–154 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```json { "mcpServers": { "t3rnel-session": { "command": "npx", "args": ["-y", "@t3ratech/mcp-session-bridge"] } } } ``` ```bash npm install -g @t3ratech/mcp-session-bridge mcp-session-bridge --install # registers the native messaging host ``` ### Technical Analysis The configuration uses `npx -y` to download and execute `@t3ratech/mcp-session-bridge` without an exact version or integrity constraint. The `-y` option suppresses the interactive installation prompt. The alternative setup likewise installs an unpinned version globally and then registers a native messaging host. Consequently, the effective code executed by the Skill can change after this repository has been reviewed. A compromised package publisher, npm account, release process, or newly published package version could introduce malicious code that executes during package installation or MCP server startup. The dependency is especially sensitive because the documented bridge can operate the user's authenticated browser tabs. The Skill also describes page evaluation, credential-vault integration, and network and console capture. Although these capabilities are relevant to the declared signed-in-browser functionality, they substantially increase the consequences of a supply-chain compromise. The audited files contain no direct evidence that the current dependency release is malicious or that page content is intentionally exfiltrated. The vulnerability is the unsafe, mutable dependency execution mechanism combined with the bridge's privileged access. ### Attack Path 1. An attacker compromises the npm publisher account, package build pipeline, or another mechanism controlling `@t3ratech/mcp-session-bridge`. 2. The attacker publishes a malicious package version under the existing pack ...[truncated 1624 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed, exact version rather than allowing npm to resolve the latest release: ```json { "mcpServers": { "t3rnel-session": { "command": "npx", "args": ["--no-install", "@t3ratech/mcp-session-bridge@<reviewed-version>"] } } } ``` 2. Install dependencies from a lockfile-backed project or a verified local artifact before startup. Do not rely on `npx -y` to download executable code dynamically. 3. Verify package provenance using npm signatures or attestations where available. Record and validate the expected package tarball integrity hash. 4. Avoid global installation unless technically required. Run the bridge under a dedicated, least-privileged operating-system account or sandbox with restricted filesystem and network access. 5. Review every package update before deployment. Use automated dependency monitoring, but do not automatically execute newly published versions in this privileged context. 6. Keep high-risk action approval enabled by default. Require explicit user confirmation for sending, publishing, deleting, purchasing, changing permissions, modifying account settings, or accessing credential-related functions. 7. Restrict the browser extension to the minimum necessary sites and tabs. Disable credential-vault, network-capture, console-capture, and arbitrary evaluation capabilities unless the current task specifically requires them. 8. Document the package publisher, expected version, integrity value, extension identifiers, and native-host installation artifacts so users can verify that they are installing the reviewed components. ]]>