T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:18
- Finding
- Unpinned npm Package Is Downloaded and Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:18`, `SKILL.md:32`, `SKILL.md:65`, `SKILL.md:81`, and `SKILL.md:109` **Vulnerability Type**: Unpinned executable third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml install: - kind: node package: "@lark-project/meego-mcporter" bins: - meego-mcporter ``` ```markdown - **@lark-project/meego-mcporter**: MCP transport utility obtained from npm (`npm install -g @lark-project/meego-mcporter` or downloaded automatically through `npx`) ``` ```bash npx @lark-project/meego-mcporter auth meego --config meego-config.json ``` ```bash npx @lark-project/meego-mcporter auth meego --config meego-config.json --oauth-timeout 1000 ``` ```bash npx @lark-project/meego-mcporter call meego <tool_name> --config meego-config.json ``` ### Technical Analysis The Skill installs or invokes `@lark-project/meego-mcporter` without specifying an exact reviewed version or integrity value. When the package is unavailable locally, `npx` can retrieve the currently resolved release from the npm registry and execute it with the privileges of the user running the agent. Consequently, the code that ultimately executes can differ from the code present when this Skill was audited. A compromised publisher account, malicious future release, registry compromise, or other supply-chain incident could cause users to execute altered package code. This risk is particularly significant because the dependency performs OAuth authentication and manages `~/.mcporter/credentials.json`. Although access to that credential file is necessary for the declared Feishu OAuth functionality and the Skill includes appropriate user-confirmation and storage restrictions, those textual restrictions cannot constrain a compromised npm package. ### Attack Path 1. An attacker compromises the npm publisher account, release process, or another component of the package distribution chain. 2. The attacker publishes an altered v ...[truncated 1386 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every installation and invocation to an exact, reviewed package version: ```yaml package: "@lark-project/meego-mcporter@1.0.10" ``` ```bash npx --yes @lark-project/meego-mcporter@1.0.10 auth meego --config meego-config.json ``` 2. Prefer installation through a lockfile-backed project rather than resolving the package independently on every invocation. 3. Commit and verify the package-lock integrity metadata or use an equivalent reproducible dependency mechanism. 4. Review package provenance, publisher identity, release signatures, and npm provenance attestations before upgrading. 5. Disable unexpected lifecycle scripts where compatible with the package, and perform dependency installation in a restricted environment. 6. Execute the package under a dedicated, minimally privileged operating-system account with access only to the required configuration and credential paths. 7. Restrict OAuth scopes to the minimum Feishu project permissions required for the requested operation. 8. Align the package version throughout the project. `SKILL.md` declares Skill version `1.0.10`, while `_meta.json` declares `1.0.9`; this discrepancy should be corrected to improve release traceability. ]]>