T08 · Insecure Dependencies
Error
- Location
scripts/scan.sh:39- Finding
Automatic Execution of Dependencies from Untrusted Target Repositories
- Content
View full analysis
/dev/null || true [ -f "requirements.txt" ] && pip3 install -r requirements.txt --quiet 2>/dev/null || true ``` ### Technical Analysis The script accepts an arbitrary repository URL, clones that repository, and then automatically runs its dependency installation procedures. The cloned repository must therefore be treated as attacker-controlled input. Running `npm install` can execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. These scripts can contain arbitrary commands. Similarly, installing Python dependencies can execute attacker-controlled build backends, source-distribution build logic, or legacy setup code. The dependencies are not validated against an allowlist, isolated from the host, or required to use cryptographic hashes. The installation commands run with the full permissions of the user who invoked the Skill. Suppressing errors and continuing with `|| true` also reduces visibility into malicious or unexpected installation behavior. Dependency installation may sometimes be necessary to compile a target, but automatically performing it on the host exceeds the minimum privileges required for static source analysis. ### Attack Path 1. An attacker creates or compromises a smart-contract repository. 2. The repository contains one of the following: - A malicious npm lifecycle script in `package.json`. - A dependency that executes malicious npm lifecycle code. - A malicious Python source package or build backend referenced by `requirements.txt`. 3. The attacker persuades a user to scan the repository or submits it as a purported bounty target. 4. The user runs: ```bash bash scripts/scan.sh ...[truncated 901 chars]- Remediation
View remediation