T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned Third-Party Dependencies Permit Unreviewed Package Code Execution## Vulnerability Details **File Location**: `requirements.txt:1-2` **Additional Locations**: `SKILL.md:15-18`, `demo_project/README.md:7-10` **Vulnerability Type**: Unpinned and unhashed third-party dependencies **Risk Level**: Medium The project installs dependencies using unrestricted minimum-version constraints: ```text xtquant>=1.0.0 pandas>=1.5.0 ``` The installation instructions cause these dependencies and their transitive dependencies to be installed and executed: ```bash pip install xtquant ``` ```bash pip install -r ../requirements.txt ``` ### Technical Analysis The `>=` constraints allow the package resolver to install any current or future version satisfying the minimum version. No lock file, package hashes, exact versions, or trusted package-index configuration are provided. Python package installation can execute package build logic, while subsequent imports execute installed package initialization code. The implementation of `xtquant` is not included in this project, so the audit could not verify the behavior of the code users are instructed to install. This does not establish that the named packages are currently malicious. It creates a supply-chain weakness in which future releases, a compromised publisher account, a compromised package index, or unsafe index precedence could introduce code that was never reviewed with this project. ### Attack Path 1. An attacker compromises a dependency publisher, distribution channel, or package source used by the installer. 2. The attacker publishes a malicious package release with a version satisfying `xtquant>=1.0.0` or `pandas>=1.5.0`. 3. A user follows the documented installation command without a previously locked environment. 4. The resolver selects the attacker-controlled or compromised release. 5. Malicious code executes during installation, import, or normal package use with the privileges of the user running Python. ### Impact Asses ...[truncated 475 chars]
- Remediation
- ## Remediation Suggestions 1. Replace minimum-version constraints with exact, reviewed versions, for example: ```text xtquant==REVIEWED_VERSION pandas==REVIEWED_VERSION ``` 2. Generate and commit a reproducible lock file that includes all transitive dependencies. 3. Require package hashes during installation, such as through a hash-locked requirements file and `pip install --require-hashes`. 4. Document and enforce the intended trusted package index rather than relying on ambient installer configuration. 5. Review package artifacts, release provenance, signatures, and dependency changes before updating locked versions. 6. Install dependencies in an isolated virtual environment under a non-privileged account. 7. Add automated dependency vulnerability and integrity scanning to the release process.