T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned Third-Party Dependencies Create a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-3` **Related Installation Instruction**: `SKILL.md:141-145` **Vulnerability Type**: Unpinned dependencies and non-reproducible package resolution **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1-3`: ```text numpy pandas scipy ``` `SKILL.md:141-145`: ```text # Python dependencies pip install -r requirements.txt ``` ### Technical Analysis The project declares `numpy`, `pandas`, and `scipy` without exact versions or package integrity hashes. Consequently, each installation can resolve to different package versions based on the package index state at installation time. Although the named packages are legitimate and no malicious dependency is present in the audited files, the configuration does not provide reproducible or integrity-verified installations. If a future release, package index response, configured mirror, or transitive dependency is compromised, users following the documented installation command could retrieve and execute unreviewed code. Python package installation and subsequent imports can execute package-controlled code with the privileges of the user running `pip` or the application. ### Attack Path 1. A dependency release, transitive dependency, package index, or configured package mirror is compromised. 2. The attacker publishes or serves a malicious version that satisfies the unrestricted dependency declaration. 3. A user follows the documented `pip install -r requirements.txt` instruction. 4. Package resolution selects the malicious or compromised version. 5. Attacker-controlled code executes during installation or when the package is imported by `scripts/main.py`. This path requires compromise or malicious control of an upstream package-distribution component; the audited repository itself does not retrieve packages from an unusual source. ### Impact Assessment Successful exploitation could execute arbitrary code with the operating-system ...[truncated 392 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to an explicitly reviewed version, for example: ```text numpy==<reviewed-version> pandas==<reviewed-version> scipy==<reviewed-version> ``` 2. Generate a lock file that includes all transitive dependencies. 3. Record cryptographic hashes and install with hash verification: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use a controlled package index or approved internal mirror. 5. Integrate dependency vulnerability and provenance scanning into release workflows. 6. Regularly update pinned versions through a reviewed process rather than allowing installations to resolve automatically to the newest available releases. 7. Install and run the project in a least-privileged virtual environment or container. ]]>