T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned Third-Party npm Packages Are Installed and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 17-24 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown Install the open-source CLI once and sign in; the CLI stores the key, so never ask the user to paste an API key into the chat: ```bash npm install -g @wavespeed/cli wavespeed login # opens https://wavespeed.ai/accesskey and stores the key wavespeed status # confirms you are signed in ``` For CI or one-off shells, `WAVESPEED_API_KEY` in the environment also works. Prefer MCP tools over shell commands? The same platform is exposed by [`@wavespeed/mcp`](https://github.com/WaveSpeedAI/mcp-server) (`npx -y @wavespeed/mcp`; tools `search_models`, `get_model_schema`, `get_price`, `upload_file`, `run_model`, `get_prediction`). ``` ### Technical Analysis The skill instructs users to install `@wavespeed/cli` globally and to download and execute `@wavespeed/mcp` through `npx -y`. Neither command specifies an exact reviewed package version. Consequently, npm resolves the package version available at execution time rather than a version whose source and integrity were established during review. The `npx -y` option is particularly sensitive because it suppresses installation confirmation and immediately executes downloaded package code. The global installation command may also run npm lifecycle scripts under the invoking user's permissions. The project provides no lockfile, package integrity hash, vendored source, or other mechanism for verifying the effective code. This is a supply-chain exposure. The audit found no evidence that the named packages are currently malicious; exploitation depends on a future or existing compromise of a package, transitive dependency, maintainer account, or package-resolution infrastructure. ### Attack Path 1. An attacker compromises `@wavespeed/cli`, `@wavespeed/mcp`, one of their transitive ...[truncated 1384 chars]
- Remediation
- ## Remediation Suggestions 1. Pin each package to an exact reviewed version, for example: ```bash npm install -g @wavespeed/cli@<reviewed-version> npx --no-install @wavespeed/mcp ``` 2. Install the MCP package as a project dependency from a lockfile instead of allowing `npx -y` to download and execute the current registry version automatically. 3. Commit a lockfile with npm integrity metadata and require reproducible installation using `npm ci`. 4. Document the expected package version and integrity hash, and verify release provenance before updating it. 5. Review direct and transitive dependency changes whenever the pinned version is upgraded. 6. Avoid running npm installation commands with administrator or root privileges. 7. Execute third-party tooling in a restricted environment with access only to the files and credentials required for the requested operation. 8. Keep API credentials scoped and revocable, and avoid exposing unrelated sensitive environment variables to the CLI or MCP process.