T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned and Unverified Third-Party Dependencies## Vulnerability Details **File Location**: `requirements.txt:1-2`; installation instructions also appear in `SKILL.md:50` and `README.md:20` **Vulnerability Type**: Supply-chain exposure through mutable dependency resolution **Risk Level**: Medium ### Vulnerable Code ```text xtquant>=1.0.0 pandas>=1.5.0 ``` The installation instructions resolve packages directly without version or integrity verification: ```bash pip install xtquant ``` ### Technical Analysis Both dependencies use open-ended minimum-version constraints. The project does not provide a lockfile, cryptographic hashes, an approved package index, or a documented package verification procedure. Consequently, separate installations can resolve to different package versions, including future versions that have not been reviewed with this Skill. Python packages may execute code during installation and whenever imported. This is particularly sensitive for `xtquant`, because the packaged demo and documented trading programs import it in an environment that may have access to a locally authenticated miniQMT brokerage terminal. This finding does not establish that the current packages are malicious; it identifies the absence of controls preventing a compromised or unexpectedly changed release from entering the environment. ### Attack Path 1. An attacker compromises an allowed future release of a declared dependency or its package-distribution account. 2. A user follows the documented installation command or installs from `requirements.txt`. 3. Because only a minimum version is specified, the package manager selects the latest compatible release. 4. Attacker-controlled code executes during package installation or import. 5. The code operates with the privileges of the Python process and may interact with resources available to that process, including files, network connections, and an accessible brokerage service. ### Impact Assessment Successful ...[truncated 415 chars]
- Remediation
- ## Remediation Suggestions 1. Replace minimum-version constraints with exact versions that have been reviewed and tested. 2. Generate a hash-locked dependency file and require hash verification during installation, for example through `pip-compile --generate-hashes` and `pip install --require-hashes`. 3. Document the approved package registry and use an explicitly configured trusted index. 4. Install dependencies in an isolated virtual environment under a non-privileged account. 5. Review dependency release notes and package artifacts before updating pinned versions. 6. Add automated dependency scanning and provenance verification to the release process. 7. Avoid running package installation or trading programs with administrator privileges.