T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:16
- Finding
- Unpinned npm Package Is Downloaded and Executed at Runtime<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-20, 31-32, 64-66, 80-82, 108-110` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```yaml install: - kind: node package: "@lark-project/meego-mcporter" bins: - meego-mcporter ``` ```markdown - **@lark-project/meego-mcporter**: MCP Transfer Tool, sourced from npm (`npm install -g @lark-project/meego-mcporter` or automatically obtained via `npx`) ``` ```bash npx @lark-project/meego-mcporter auth meegle --config meegle-config.json ``` ```bash npx @lark-project/meego-mcporter auth meegle --config meegle-config.json --oauth-timeout 1000 ``` ```bash npx @lark-project/meego-mcporter call meegle <tool_name> --config meegle-config.json ``` ### Technical Analysis The dependency is identified only by its package name. No exact version, package-lock file, integrity hash, or other immutable reference is supplied. Consequently, npm or `npx` may resolve and execute a package release that differs from the version reviewed when this Skill was published. The command is particularly sensitive because it runs as the local agent user and is responsible for OAuth authentication. It can therefore interact with `~/.mcporter/credentials.json` and other files accessible to that user. This finding does not establish that the current npm package is malicious. It identifies a supply-chain weakness under which a future compromised or malicious package release could alter the effective executable payload without any corresponding change to the audited Skill files. ### Attack Path 1. An attacker compromises the npm publisher account, registry distribution path, or a future release of `@lark-project/meego-mcporter`. 2. The attacker publishes a modified package under the same package name. 3. A user follows the Skill instructions and invokes an unversioned `npx` or global installation command. 4. npm resolves and downloads the attacker-cont ...[truncated 913 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version in both installation metadata and every command, for example: ```bash npx --yes @lark-project/meego-mcporter@1.0.9 auth meegle --config meegle-config.json ``` 2. Ensure the pinned version is the actual reviewed version; do not assume that the Skill version and npm package version are equivalent. 3. Prefer installation from a lockfile with npm integrity metadata rather than resolving the package dynamically on every invocation. 4. Use `npm ci` or an equivalent reproducible installation mechanism in a controlled directory. 5. Verify registry configuration and package provenance before installation. 6. Disable or restrict package lifecycle scripts where compatible with the package. 7. Run the connector under a dedicated, least-privileged account with access only to the required configuration and credential file. 8. Establish a controlled dependency-update process that requires security review before changing the pinned version or integrity value. ]]>