T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:32
- Finding
- Unpinned Archived npm Package Executes with GitHub Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 32–39 and 53–59 **Vulnerability Type**: Unpinned third-party dependency execution in a credential-bearing process **Risk Level**: Medium ### Vulnerable Code ```bash # Community-maintained GitHub MCP server npm install -g @modelcontextprotocol/server-github # Or build from source git clone https://github.com/modelcontextprotocol/servers-archived cd servers-archived/src/github npm install npm run build ``` ```json { "mcpServers": { "github": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-github"], "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_your_token_here" } } } } ``` ### Technical Analysis The installation and configuration instructions execute `@modelcontextprotocol/server-github` without pinning an exact audited version or requiring integrity verification. In particular, `npx -y` may automatically retrieve and execute the package from the configured npm registry. The source-build alternative clones an archived repository without pinning an immutable commit and installs its transitive dependencies without documented verification. Because the resulting MCP server process receives `GITHUB_PERSONAL_ACCESS_TOKEN` through its environment, any malicious code introduced through the package, a transitive dependency, the registry, or the mutable source reference could read that credential. This is a supply-chain exposure; the audit found no evidence that the currently referenced package is itself malicious. ### Attack Path 1. An attacker compromises the npm package, one of its transitive dependencies, the configured registry response, or the referenced source repository. 2. A user follows the documented installation or MCP configuration instructions. 3. `npm`, `npx -y`, or the source build retrieves and executes the compromised code without an exact version or immutable re ...[truncated 874 chars]
- Remediation
- ## Remediation Suggestions - Replace the archived implementation with a current implementation from an official, verified publisher. - Pin the npm package to an exact version that has been reviewed rather than using an unconstrained package name. - Avoid `npx -y` for runtime retrieval in a process that receives credentials. Install and verify the dependency separately before configuring the MCP client. - When building from source, pin an immutable commit hash or signed release tag and verify its provenance. - Use a reviewed lockfile with integrity hashes and enforce reproducible installation, such as `npm ci`. - Review and monitor transitive dependencies with dependency auditing and automated update tooling. - Use short-lived, fine-grained GitHub credentials restricted to required repositories and operations. - Default to read-only permissions and grant write permissions only when a specific workflow requires them. - Rotate the GitHub token immediately if dependency compromise is suspected, and review GitHub audit logs for unauthorized activity.