T08 · Insecure Dependencies
Error
- Location
- SKILL.md:21
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 21-34 **Vulnerability Type**: Unpinned external npm dependency execution **Risk Level**: High ### Vulnerable Code ```json { "mcpServers": { "veil-protocol": { "command": "npx", "args": ["@veil_/agent-registry"] } } } ``` ```bash npm install @veil_/agent-registry ``` ### Technical Analysis The documented setup downloads and executes `@veil_/agent-registry` without specifying an exact version, validating an integrity hash, or providing a lockfile. The project contains only `SKILL.md`; therefore, the external package's implementation and its claimed cryptographic behavior cannot be audited from the supplied artifact. Invoking an unpinned package through `npx` allows the package resolved by the npm registry at execution time to run with the permissions of the MCP client. The effective executable payload may consequently differ from the version originally reviewed. Package-account compromise, a malicious release, registry compromise, or supply-chain substitution could introduce arbitrary code. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or its dependency chain. 2. The attacker publishes a malicious version under the existing package name. 3. A user copies the documented MCP configuration or installation command. 4. `npx` or `npm install` resolves the unpinned package to the malicious release. 5. The package executes with the MCP client's user-level permissions. 6. The malicious code can access data and resources available to that process, including MCP inputs, environment variables, local files permitted to the user, and network connectivity. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the account running the MCP client. The accessible scope may include user-readable files, wallet-related inputs passed to the server, environment va ...[truncated 212 chars]
- Remediation
- ## Remediation Suggestions - Pin the package to an exact, independently audited version rather than resolving the latest release. - Commit and enforce a lockfile with npm integrity metadata. - Verify the downloaded package artifact against a published cryptographic checksum or signed provenance record. - Avoid automatic package retrieval during routine MCP startup; install and review the approved artifact separately. - Publish the complete source corresponding to the npm artifact and provide reproducible-build instructions. - Audit both the direct package and its transitive dependency tree. - Run the MCP server in a sandbox with restricted filesystem access, minimal environment variables, and tightly controlled network access. - Establish an update-review process so package upgrades cannot silently alter the executable payload.