T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:16
- Finding
- Unpinned Third-Party CLI and MCP Package Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 16–17 and 23 **Vulnerability Type**: Unpinned third-party dependencies and automatic package execution **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @wavespeed/cli wavespeed login # opens https://wavespeed.ai/accesskey and stores the key ``` ```text npx -y @wavespeed/mcp ``` ### Technical Analysis The Skill instructs users to globally install `@wavespeed/cli` and automatically download and execute `@wavespeed/mcp` without specifying reviewed versions or integrity hashes. Because no versions are pinned, npm resolves mutable package releases at installation or execution time. The `npx -y` option suppresses the normal installation confirmation and immediately executes the resolved package. npm package lifecycle scripts may also run during installation. The repository provides no lockfile, checksums, vendored package source, or other controls that would allow the executed implementation to be verified against a reviewed artifact. This creates a supply-chain trust boundary: a compromise of a package publisher, npm account, package release, or transitive dependency could cause arbitrary code to execute locally when a user follows the documented instructions. ### Attack Path 1. An attacker compromises `@wavespeed/cli`, `@wavespeed/mcp`, or one of their resolved dependencies or publishing accounts. 2. The attacker publishes a malicious release under the expected package name. 3. A user follows `SKILL.md` and runs the unversioned global installation or `npx -y` command. 4. npm resolves the attacker-controlled release because no reviewed version or integrity value is required. 5. Malicious lifecycle or package code executes with the privileges of the invoking user. 6. The malicious code may inspect local files, steal WaveSpeed authentication material, alter model requests or responses, or establish additional local compromise within the user's permission boundary. ### Imp ...[truncated 644 chars]
- Remediation
- ## Remediation Suggestions 1. Pin each package to a specifically reviewed version, for example: ```bash npm install --global @wavespeed/cli@<reviewed-version> npx --no-install @wavespeed/mcp ``` 2. Remove `npx -y` so that package retrieval and execution cannot proceed automatically without confirmation. 3. Prefer a project-local installation over a global installation to reduce system-wide exposure. 4. Commit and enforce an npm lockfile with integrity metadata where the deployment model permits it. 5. Verify package provenance, publisher identity, signatures, and registry source before installation. 6. Use trusted package registries and package-manager controls that reject unexpected registry substitution. 7. Document the approved package version and checksum so users can verify that the downloaded artifact matches the audited release. 8. Run the packages with least privilege in an isolated environment, without unrelated credentials or access to sensitive local files. 9. Review package lifecycle scripts and transitive dependencies before approving version updates. 10. Treat upgrades as security-sensitive changes and repeat the dependency review whenever the pinned version changes.