T08 · Insecure Dependencies
Warning
- Location
- mcporter.json:4
- Finding
- Unpinned MCP server package is downloaded and executed through npx## Vulnerability Details **File Location**: `mcporter.json`, lines 4-10 **Vulnerability Type**: Unpinned runtime dependency execution **Risk Level**: Medium ### Vulnerable Code ```json "zai-mcp-server": { "type": "stdio", "command": "npx", "args": ["-y", "@z_ai/mcp-server"], "env": { "Z_AI_API_KEY": "$env:ZAI_MCP_API_KEY", "Z_AI_MODE": "ZHIPU" } } ``` ### Technical Analysis The configuration launches `@z_ai/mcp-server` through `npx -y` without specifying an exact version. No package lockfile or integrity hash is present in the audited project. When the package is not already available in the applicable local cache or installation, `npx` can retrieve it from the configured package registry. Because no version is pinned, the code executed on future invocations can differ from the code that was previously reviewed. The `-y` option suppresses the installation confirmation, allowing the package to be retrieved and executed without an explicit user approval step. The MCP server also receives the Zhipu API credential through `Z_AI_API_KEY`. Consequently, malicious code introduced through a compromised package release or dependency chain would execute with the invoking user's operating-system permissions and receive that credential. ### Attack Path 1. An attacker compromises the registry account, publication pipeline, or dependency chain associated with `@z_ai/mcp-server`. 2. The attacker publishes a malicious package version under the same package name. 3. A user invokes the `zai-mcp-server` integration. 4. `npx -y @z_ai/mcp-server` resolves and, where necessary, downloads the unpinned package version. 5. The malicious package executes with the user's privileges. 6. It reads the supplied `Z_AI_API_KEY` environment variable and may access other resources available to the user. 7. The credential or accessible local data can then be transmitted to an attacker-controlled destination. ### Imp ...[truncated 590 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@z_ai/mcp-server` to an exact, reviewed version rather than relying on the registry's current version. 2. Install dependencies during a controlled deployment step instead of downloading them when the Skill is invoked. 3. Add and enforce a package lockfile containing registry-resolved integrity hashes. 4. Use deterministic installation commands such as `npm ci` in the build or installation process. 5. Invoke the installed package from a fixed local path rather than using runtime `npx -y` resolution. 6. Review package provenance, publisher identity, release signatures, and transitive dependencies before upgrades. 7. Run the MCP server in a restricted environment with only the required API credential and minimal filesystem and network access. 8. Rotate the Zhipu API key if an untrusted or compromised package version may already have been executed.