T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unbounded and Unverified Third-Party Dependencies
- Content
View full analysis
=2.0.0 numpy>=1.24.0 requests>=2.31.0 urllib3>=2.0.0 ``` ### Technical Analysis All dependencies use lower-bound-only version constraints. Consequently, a future installation may retrieve any newer release accepted by the Python package resolver. The file also provides no cryptographic hashes to verify downloaded distributions. This makes installations non-reproducible and exposes the project to upstream package compromise, malicious future releases, dependency-resolution changes, and newly introduced vulnerabilities. The packages currently named are legitimate mainstream packages, and the audit found no evidence that the project intentionally references a malicious or typosquatted dependency. The risk arises from the dependency policy rather than a known malicious package in the reviewed snapshot. The documented installation command, `pip install -r requirements.txt`, executes package build and installation logic. If the resolver selects a compromised package release or transitive dependency, attacker-controlled installation or runtime code can execute with the privileges of the user running `pip`. ### Attack Path 1. An attacker compromises an allowed upstream package release, its publishing account, distribution infrastructure, or an unconstrained transitive dependency. 2. The attacker publishes a version newer than the minimum specified in `requirements.txt`. 3. A user or automated deployment follows the documented setup procedure and runs: ```bash pip install -r requirements.txt ``` 4. Pip resolves the compromised release because no upper bound, exact version, lock file, or hash prevents its selection. 5. Malicious package installation hooks, build-system logic, or imported runtime code executes in the installation e ...[truncated 1063 chars]- Remediation
View remediation
numpy== requests== urllib3== ``` 2. Generate a deterministic lock file that includes all transitive dependencies. Tools such as `pip-tools`, Poetry, or uv can be used to resolve and maintain the complete dependency graph. 3. Require cryptographic hashes during installation: ```bash pip install --require-hashes -r requirements.txt ``` Generate the corresponding hash-pinned requirements file from trusted artifacts. 4. Configure pip to use an explicitly trusted package index and disallow unexpected supplemental indexes where dependency confusion could occur. 5. Install dependencies in an isolated, non-privileged virtual environment or container. Do not run dependency installation as root. 6. Add automated dependency auditing with tools such as `pip-audit` and dependency update review through a controlled pull-request process. 7. Rebuild and test the lock file periodically so security updates are adopted intentionally rather than automatically accepting every future release. ]]>