T08 · Insecure Dependencies
Error
- Location
SKILL.md:17- Finding
Automatic Execution of an Unverified Third-Party npm Package
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 17-25
Vulnerability Type: Supply-chain risk caused by automatic third-party package retrieval and execution
Risk Level: HighVulnerable Code
markdown Add the Reposit MCP server to your configuration: ```json { "mcpServers": { "reposit": { "command": "npx", "args": ["-y", "@reposit-bot/reposit-mcp@0.3.11"] } } }text ### Technical Analysis The configuration directs the host to invoke `npx` with the `-y` option. This automatically approves package installation, retrieves `@reposit-bot/reposit-mcp@0.3.11` and its dependencies from the npm ecosystem, and executes the resulting third-party code under the current user's account. Pinning the direct dependency to version `0.3.11` limits unexpected direct-version upgrades, but the project does not include the package source, a dependency lock file, vendored dependencies, integrity hashes, or signature-verification instructions. Consequently, the code that users are instructed to execute cannot be audited from this repository. Transitive dependencies may also remain insufficiently constrained by this configuration. This is a supply-chain exposure rather than evidence that the named package is malicious. Exploitation requires compromise or malicious publication somewhere in the retrieved dependency chain. ### Attack Path 1. An attacker compromises a relevant npm publisher, package artifact, registry delivery path, or unresolved transitive dependency. 2. The attacker introduces malicious installation-time or runtime code into a component retrieved by `npx`. 3. A user installs or loads the documented MCP configuration. 4. The host runs: ```bash npx -y @reposit-bot/reposit-mcp@0.3.11 ``` 5. The `-y` option suppresses interactive installation approval, and npm retrieves the package and required dependencies. 6. The compromised code executes with ...[truncated 976 chars]- Remediation
View remediation
Remediation Suggestions
- Vendor or otherwise make the MCP server source available for review alongside the skill.
- Generate and enforce a lock file that pins the complete transitive dependency graph.
- Verify downloaded artifacts with trusted integrity hashes or cryptographic signatures before execution.
- Replace automatic
npx -yexecution with an explicit installation and review process that requires user approval. - Install dependencies using a reproducible, controlled build process and a trusted registry configuration.
- Scan direct and transitive dependencies for known vulnerabilities and suspicious installation scripts.
- Run the MCP server in a sandbox or container with:
- Read-only access to only the required project paths
- No access to unrelated home-directory files
- Minimal environment variables
- Restricted outbound network access
- A dedicated, unprivileged operating-system account
- Store
REPOSIT_TOKENin a dedicated secret store where possible. If the documented configuration file must be used, enforce restrictive permissions such aschmod 600 ~/.reposit/config.json. - Establish a controlled update process that reviews source and dependency changes before approving a new package version.