T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:108
- Finding
- Unpinned npm Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md:108-109, 156` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```json "command": "npx", "args": ["aiprox-workflows-mcp"] ``` ```text npx aiprox-workflows-mcp ``` ### Technical Analysis The documented configuration executes `aiprox-workflows-mcp` through `npx` without specifying an exact package version or verifying its integrity. If the package is not already available locally, `npx` may retrieve and execute the package currently published under that name. Consequently, the effective executable can change after this Skill has been reviewed. The project provides no lockfile, package integrity hash, trusted-registry restriction, or package-publisher verification. The MCP configuration also supplies `AIPROX_SPEND_TOKEN` to the spawned process through its environment at `SKILL.md:109-112`, increasing the sensitivity of the dependency boundary. This finding does not establish that the current package is malicious. It identifies a supply-chain weakness through which a compromised or malicious future package release could be executed. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or the relevant package-distribution path. 2. The attacker publishes a malicious release under the expected package name. 3. A user follows the Skill instructions and starts the MCP server with `npx aiprox-workflows-mcp`. 4. Because no exact version or integrity value is specified, `npx` resolves and executes the mutable package release. 5. The malicious package runs with the operating-system privileges of the invoking user and can read environment variables exposed to the process, including `AIPROX_SPEND_TOKEN`. 6. It may misuse the token, access other resources available to the user, or execute additional commands within that privilege boundary. ### Impact Assessment Successful exploitation permits arbitrary code execution with ...[truncated 501 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the MCP package to a reviewed, exact version rather than resolving a mutable latest release: ```json "command": "npx", "args": ["--yes", "aiprox-workflows-mcp@X.Y.Z"] ``` 2. Prefer a controlled installation process backed by a lockfile and npm integrity metadata, then invoke the verified local executable. 3. Configure npm to use an explicitly trusted registry and verify the package name, publisher, provenance, and release signatures where available. 4. Review package updates before changing the pinned version, including transitive dependency and integrity changes. 5. Use a narrowly scoped, revocable `AIPROX_SPEND_TOKEN` with strict spending limits. 6. Run the MCP server in an isolated environment with minimal filesystem, network, and operating-system permissions. 7. Avoid exposing unrelated secrets to the MCP process and establish a documented token-rotation procedure for suspected package compromise.