@paypal/mcp declares "@paypal/agent-toolkit": "latest", so the tool set and security behavior users get changes without notice

Package: @paypal/mcp 1.8.1

Summary

The published package.json of @paypal/mcp 1.8.1 declares the dependency "@paypal/agent-toolkit": "latest" with no version floor or cap, and the tarball ships no lockfile. Every fresh install resolves whatever the toolkit's newest version is at that moment. For a payment server this has two effects:

1. Security-relevant behavior is not pinned. The tool menu, argument validation, and dispatch behavior all live in the toolkit (this audit verified that unregistered tools are correctly rejected at dispatch in toolkit 1.10.0), but a future toolkit release could change that behavior and every @paypal/mcp user would pick it up silently on their next install.
2. Builds are not reproducible. Two installs of the same @paypal/mcp version can run different code, which breaks incident response ("what exactly was running?") for anything touching money.

The same package pins its other dependencies with caret ranges (@modelcontextprotocol/sdk ^1.6.1, colors ^1.4.0), which makes the bare "latest" stand out.

Steps to reproduce (offline, from the pinned tarball)

Pin: @paypal/mcp@1.8.1 (npm tarball sha256 7447903566e370f9fed9dce9a1e6c51f4b90bc3af0c2c03aa7cbec5278792042).

1. Read package.json inside the tarball: "dependencies": { "@modelcontextprotocol/sdk": "^1.6.1", "colors": "^1.4.0", "@paypal/agent-toolkit": "latest" }.
2. Confirm no lockfile ships in the tarball (npm pack contents list: dist, LICENSE, package.json, README.md only).

Observed: the floating range is present at the pin; during this audit "latest" resolved to @paypal/agent-toolkit 1.10.0 (published before the audit), which is what was tested.

Suggested fix

Pin the toolkit to a caret range (for example ^1.10.0) so installs are at least floor-bounded and predictable per release, and cut a new @paypal/mcp release whenever the toolkit changes security-relevant behavior. Consider shipping the resolved version in a lockfile for CI installs.

Determinism statement

The finding is a property of the pinned tarball itself (its package.json), re-read twice with identical content. The resolution behavior it describes is by definition not deterministic over time, which is the point of the finding.

Honesty ledger

• No defective toolkit behavior was found; this is a supply-chain hygiene finding only.
• The version that "latest" resolved to during the audit is recorded in manifest.json; it may differ for future installs.

Start by locating the source package.json for @paypal/mcp and compare it with the published 1.8.1 tarball, whose dependency manifest and contents are described here. Verify how the package is packed and released, then replace the floating toolkit dependency with the project’s intended bounded version and confirm the packed manifest no longer uses "latest".