T08 · Insecure Dependencies
Error
- Location
- install.sh:8
- Finding
- Unpinned Third-Party MCP Package Is Downloaded and Executed## Vulnerability Details **File Location**: `install.sh`, line 8 **Additional Location**: `mcp-config.json`, lines 4-5 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: High ### Vulnerable Code `install.sh`: ```bash # Install the MCP server globally npm install -g truthsea-mcp-server ``` `mcp-config.json`: ```json "command": "npx", "args": ["-y", "truthsea-mcp-server"], ``` ### Technical Analysis The installer downloads `truthsea-mcp-server` without specifying an exact version or verifying an integrity hash. The runtime configuration independently invokes the same unpinned package through `npx -y`, which permits automatic retrieval and execution without interactive confirmation. Consequently, the code reviewed during one installation is not guaranteed to be the code executed later. A newly published, compromised, or otherwise unsafe npm release could be selected automatically. The global installation also does not ensure that `npx` will execute the same previously reviewed package version. The effective MCP server implementation is not included in the audited project. Therefore, this audit cannot verify the documentation's assertion that the server never transmits or logs `DEPLOYER_PRIVATE_KEY`. When configured, that private key is supplied to the external MCP process through its environment and can be read by any code executing inside that process. ### Attack Path 1. An attacker compromises the npm account, package publication process, or another relevant component of the `truthsea-mcp-server` supply chain. 2. The attacker publishes a malicious version under the expected package name. 3. A user runs `install.sh`, causing npm to resolve and install the unpinned malicious release, or starts the MCP integration, causing `npx -y` to retrieve and execute it. 4. The malicious package executes with the privileges of the user running the agent. 5. If configured, the package reads `DEPLOYER_ ...[truncated 849 chars]
- Remediation
- ## Remediation Suggestions 1. Pin a reviewed exact package version in both installation and execution paths, for example: ```bash npm install --global --save-exact truthsea-mcp-server@2.5.0 ``` 2. Remove the unpinned `npx -y` runtime invocation. Install the dependency locally and invoke its verified local executable directly. 3. Commit a lockfile containing resolved versions and integrity metadata, and use `npm ci` for reproducible installation. 4. Verify the package provenance and registry integrity before installation. Consider requiring npm provenance attestations and approving package hashes in deployment policy. 5. Vendor or separately audit the MCP server implementation because it receives sensitive signing credentials and performs blockchain operations. 6. Supply the private key only at runtime through a secret manager rather than placing it directly in persistent configuration. 7. Continue using a dedicated, minimally funded wallet, and additionally restrict token approvals, contract permissions, and available balances. 8. Run the MCP server in a sandbox with limited filesystem and network access so dependency compromise does not grant unrestricted access to the host account. 9. Establish an explicit dependency-update process in which new versions are reviewed, tested, and approved before deployment.