T08 · Insecure Dependencies
Warning
- Location
- modules/quality-metrics.md:184
- Finding
- Unpinned Third-Party Package Installation and Immediate Execution<![CDATA[ ## Vulnerability Details **File Location**: `modules/quality-metrics.md:184-186` **Vulnerability Type**: Unpinned dependency installation from a mutable package registry **Risk Level**: Medium ### Vulnerable Code ```text **Measure**: `pip install textstat; python -c "import textstat,sys; print(textstat.flesch_reading_ease(open(sys.argv[1]).read()))" file.md`. ``` ### Technical Analysis The documented measurement procedure instructs an agent or user to install `textstat` without specifying a version, package hash, trusted index, or locked dependency set. It then immediately imports the installed package. Because the dependency is resolved from mutable package-registry state at execution time, the code ultimately executed may differ from what was reviewed. Installation can also execute package build hooks, while the subsequent import executes the package's initialization code. The same risk extends to transitive dependencies selected by the package resolver. This is a supply-chain weakness rather than evidence that the named package is currently malicious. Exploitation would require compromise of the package, one of its dependencies, the configured package index, or the dependency-resolution path. ### Attack Path 1. An attacker compromises a release of `textstat`, one of its transitive dependencies, or a package index used by the environment. 2. The compromised distribution includes malicious installation, build, or import-time code. 3. A user or agent follows the documented reading-level measurement procedure. 4. `pip install textstat` resolves and installs the attacker-controlled distribution because no audited version or integrity hash is required. 5. The following `python -c` command imports `textstat`, executing its import-time code. 6. The payload runs with the operating-system permissions and environmental access of the user who invoked the command. ### Impact Assessment Successful exploitation could provide arbitrary code execution un ...[truncated 507 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `textstat` and all transitive dependencies to reviewed versions in a lock file or requirements file. 2. Record cryptographic hashes and enforce them during installation, for example: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Configure an approved package index explicitly and disable unintended supplemental indexes to reduce dependency-confusion exposure. 4. Perform installation inside an isolated virtual environment or disposable container rather than the user's global Python environment. 5. Avoid runtime package installation when possible. Declare the measurement tool as a reviewed development dependency and provision it during a controlled setup phase. 6. Scan and periodically update the locked dependency set using an established dependency-review process. 7. Separate installation from execution so dependency changes can be inspected before the package is imported. ]]>