T08 · Insecure Dependencies
Warning
- Location
scripts/requirements.txt:1- Finding
Open-Ended Dependency Versions Permit Unreviewed Supply-Chain Updates
- Content
View full analysis
=1.0.34 python-dotenv>=1.0.0 ``` The installation script installs these unresolved dependency versions directly: ```bash #!/bin/bash pip install -r "$(dirname "$0")/requirements.txt" ``` ### Technical Analysis Both dependencies use open-ended minimum-version constraints. Consequently, each installation may retrieve a different future release without an upper bound, integrity hash, or lock file. Those future releases have not necessarily been reviewed with the Skill. This is particularly sensitive for `dataforseo-client`, because the package is imported into the application and receives the configured DataForSEO credentials. A malicious or compromised future version could execute code during installation or import and access environment variables, local files, or network resources with the privileges of the user running the Skill. No evidence was found that the currently named packages are typosquatted or malicious. The vulnerability is the uncontrolled trust placed in all future releases satisfying the lower-bound constraints. ### Attack Path 1. An attacker compromises the publishing account, distribution channel, or a future release of one of the permitted dependencies. 2. The attacker publishes a version higher than the specified minimum. 3. A user follows the documented setup procedure and runs `scripts/setup.sh` or the equivalent `pip install -r scripts/requirements.txt`. 4. `pip` resolves and installs the attacker-controlled release because it satisfies the open-ended constraint. 5. Malicious package code executes during an applicable installation or import stage. 6. The malicious code operates with the installing user's privileges and may read the DataForSEO credentials from the environment ...[truncated 596 chars]- Remediation
View remediation
python-dotenv== ``` 2. Generate and commit a reproducible lock file using a tool such as `pip-tools`, Poetry, or uv. 3. Include cryptographic hashes for every direct and transitive dependency and install with hash enforcement: ```bash pip install --require-hashes -r requirements.txt ``` 4. Review release notes and package provenance before updating any pinned version. 5. Perform dependency vulnerability and package-integrity scanning in CI. 6. Install dependencies in an isolated virtual environment rather than the system Python environment. 7. Consider using a trusted internal package mirror and restricting package installation to approved artifacts. ]]>