T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned and Unverified Third-Party Dependencies## Vulnerability Details **File Location**: `requirements.txt:1-2` **Vulnerability Type**: Supply-chain risk from open-ended dependency constraints **Risk Level**: Medium ```text ebooklib>=0.18 chardet>=5.0 ``` The associated installation instruction appears at `SKILL.md:39-43`: ```bash python3 -m pip install -r /Users/loid/.claude/skills/txt-to-epub/requirements.txt ``` ### Technical Analysis Both dependencies use open-ended minimum-version constraints. Consequently, a future installation may retrieve versions that were not present during this audit. The project provides no lock file, package hashes, or other integrity controls to ensure that users install specifically reviewed artifacts. Python package installation can execute package build hooks with the privileges of the user running `pip`. Runtime imports also execute dependency initialization code. Therefore, compromise of an eligible dependency release or its distribution path could introduce attacker-controlled code even though the project’s own conversion script contains no identified malicious behavior. This finding represents a supply-chain exposure rather than evidence that the currently published `ebooklib` or `chardet` packages are malicious. ### Attack Path 1. An attacker compromises an eligible future release of `ebooklib` or `chardet`, an associated maintainer account, or the package-delivery path. 2. The attacker publishes a version satisfying `ebooklib>=0.18` or `chardet>=5.0`. 3. A user follows the documented `pip install -r requirements.txt` instruction. 4. The dependency resolver selects the compromised version because no exact version or artifact hash is enforced. 5. Attacker-controlled code runs through package installation hooks or when `scripts/txt_to_epub.py` imports the dependency. ### Impact Assessment Successful exploitation would execute code with the privileges of the account performing installation or running the converter. Within that account’s access s ...[truncated 295 chars]
- Remediation
- ## Remediation Suggestions 1. Replace open-ended constraints with exact versions that have been reviewed and tested: ```text ebooklib==<reviewed-version> chardet==<reviewed-version> ``` 2. Generate a hash-locked dependency file containing hashes for every permitted distribution artifact. 3. Enforce integrity verification during installation: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Install dependencies inside a dedicated virtual environment or other restricted environment rather than into a privileged or shared Python installation. 5. Configure an explicit trusted package index or vetted internal mirror where appropriate. 6. Use automated dependency scanning and a controlled update process to review new versions before changing the pins and hashes.