T08 · Insecure Dependencies
Warning
- Location
- references/coverage-python.md:8
- Finding
- Unpinned Third-Party Python Tool Installation## Vulnerability Details **File Location**: `references/coverage-python.md`, lines 8–10 **Vulnerability Type**: Unpinned third-party dependencies installed from the configured Python package index **Risk Level**: Medium **Vulnerable Code**: ```bash python -m pip install pytest pytest-cov coverage # optional type checking python -m pip install mypy ``` ### Technical Analysis The documented prerequisite commands install third-party Python packages without exact version constraints, hash verification, a reviewed lock file, or an explicit trusted package source. Consequently, the packages and their transitive dependencies may resolve to different artifacts on different runs. Python packages can execute code during installation or when the installed tools are subsequently invoked. If the configured package index, a named package, or one of its transitive dependencies is compromised, following these instructions could introduce and execute attacker-controlled code. The instructions also do not require an isolated virtual environment, so installations may modify the active user or system Python environment, depending on its configuration and the invoking account's privileges. This finding concerns unsafe dependency acquisition practices. The audit found no evidence that the specifically named packages are currently malicious. ### Attack Path 1. An attacker compromises a package release, one of its transitive dependencies, or the package index used by pip. 2. A user or agent follows the documented prerequisite commands. 3. Because versions and hashes are not constrained, pip resolves and downloads the attacker-controlled artifact. 4. Malicious package code executes during installation or when `pytest`, `pytest-cov`, `coverage`, or `mypy` is invoked. 5. The payload operates with the privileges of the account running pip and may access files, repository data, environment variables, tokens, and network resources available to th ...[truncated 645 chars]
- Remediation
- ## Remediation Suggestions 1. Create a dedicated virtual environment before installing audit tools: ```bash python -m venv .venv . .venv/bin/activate ``` 2. Maintain the tools in a reviewed requirements or lock file with exact versions and hashes: ```text pytest==<reviewed-version> --hash=sha256:<reviewed-hash> pytest-cov==<reviewed-version> --hash=sha256:<reviewed-hash> coverage==<reviewed-version> --hash=sha256:<reviewed-hash> mypy==<reviewed-version> --hash=sha256:<reviewed-hash> ``` 3. Install only the verified artifacts: ```bash python -m pip install --require-hashes -r requirements-tools.txt ``` 4. Pin and verify transitive dependencies through a lock-generation workflow such as `pip-tools`, and review updates before merging them. 5. Use an explicitly configured trusted internal package mirror where available. 6. Run dependency installation and analysis in a sandbox or minimally privileged CI container without production credentials. 7. Avoid global or privileged pip installation and periodically scan the locked tool dependencies for known vulnerabilities.