T08 · Insecure Dependencies
Error
- Location
- SKILL.md:73
- Finding
- Unpinned MCP Package Is Downloaded and Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:73-152` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: High ### Complete Code Snippet ```bash npx @orderly.network/mcp-server init --client <client> ``` ```json { "mcpServers": { "orderly": { "command": "npx", "args": ["@orderly.network/mcp-server@latest"] } } } ``` ```json { "mcpServers": { "orderly": { "command": "npx", "args": ["@orderly.network/mcp-server@latest"] } } } ``` ```json { "servers": { "orderly": { "command": "npx", "args": ["@orderly.network/mcp-server@latest"] } } } ``` ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "orderly": { "type": "local", "command": ["npx", "@orderly.network/mcp-server@latest"], "enabled": true } } } ``` ```toml [mcp_servers.orderly] command = "npx" args = ["@orderly.network/mcp-server@latest"] ``` ### Technical Analysis The documented configurations instruct AI clients to use `npx` to retrieve and execute `@orderly.network/mcp-server@latest`. The `@latest` tag is mutable and can resolve to package contents that differ from those reviewed when this skill was published. The initial installation command is also unversioned and therefore resolves through the registry at execution time. Because these configurations are stored in MCP client configuration files, execution is not limited to a one-time setup action. A configured client may invoke the package again in later sessions. The package then runs as the current operating-system user and receives whatever filesystem, environment, network, and process access is available to that user and the hosting AI client. No malicious package contents were present in the audited artifact, and compromise of the referenced package was not establis ...[truncated 1629 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace every `@latest` reference with an exact, reviewed package version, such as `@orderly.network/mcp-server@X.Y.Z`. 2. Pin the package and transitive dependency graph through a committed lockfile where the client supports it. 3. Verify npm package provenance, signatures, and integrity hashes before installation or execution. 4. Install the reviewed package ahead of time and configure the MCP client to invoke a fixed local binary rather than dynamically resolving it through `npx`. 5. Disable automatic package downloads in persistent MCP configurations. 6. Run the MCP server in a sandbox or container with access restricted to the required project directories and network destinations. 7. Document the server's required filesystem, environment-variable, network, and subprocess permissions. 8. Establish a controlled upgrade process in which new versions are reviewed and tested before the pinned version is changed. ]]>