T08 · Insecure Dependencies
Error
- Location
- SKILL.md:65
- Finding
- Unpinned npm Package Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:29`, `SKILL.md:65`, `SKILL.md:78`, `SKILL.md:108` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```markdown - **@lark-project/meego-mcporter**: MCP Transfer Tool, sourced from npm (`npm install -g @lark-project/meego-mcporter` or automatically obtained via `npx`) ``` ```bash npx @lark-project/meego-mcporter auth meegle --config meegle-config.json ``` ```bash npx @lark-project/meego-mcporter auth meegle --config meegle-config.json --oauth-timeout 1000 ``` ```bash npx @lark-project/meego-mcporter call meegle <tool_name> --config meegle-config.json ``` ### Technical Analysis The documented installation and execution commands do not pin `@lark-project/meego-mcporter` to an exact, reviewed version. When the package is unavailable locally, `npx` can retrieve it from the npm registry and immediately execute its lifecycle or application code. Consequently, the code executed by the Skill can change after this package has been audited. The package runs with the permissions of the user invoking the Skill. It also implements the OAuth process and accesses `~/.mcporter/credentials.json`, making dependency compromise particularly sensitive. The repository contains neither a lockfile nor an integrity hash that would constrain the downloaded artifact to an audited release. This does not establish that the current npm package is malicious. It establishes an unsafe, mutable supply-chain execution path through which a future compromised or unexpectedly changed release could execute arbitrary code. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or the package publication process. 2. The attacker publishes a malicious version under the legitimate package name. 3. A user follows the Skill instructions and invokes an unversioned `npx` or global installation command. 4. npm resolves and downloads the attacker-contro ...[truncated 899 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every installation and invocation to a reviewed exact version: ```bash npx --yes @lark-project/meego-mcporter@1.0.9 auth meegle --config meegle-config.json ``` The example version must be replaced if `1.0.9` is not the independently verified package version intended by the publisher. 2. Prefer installing the verified dependency once and invoking the installed binary rather than permitting automatic retrieval during every operation. 3. Use a lockfile and verify npm package integrity metadata or cryptographic provenance before execution. 4. Disable or review dependency lifecycle scripts where operationally possible. 5. Document an approved package version, publisher identity, package checksum, and controlled update procedure. 6. Run the connector under a dedicated, non-privileged account with access only to the required configuration and credential path. 7. Review package updates before changing the pinned version, especially code responsible for OAuth, credential persistence, subprocess execution, and network requests. ]]>