T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unbounded Third-Party Dependencies in a Financial Trading Environment
- Content
View full analysis
=1.0.0 pandas>=1.5.0 ``` The installation documentation executes these specifications directly: ```bash pip install -r ../requirements.txt ``` ### Technical Analysis Both dependencies use minimum-version constraints rather than exact, reviewed versions. Consequently, any future release satisfying these constraints may be selected during installation. The project provides no lockfile, package hashes, or repository URL through which users can validate dependency provenance. Python packages may execute code during installation or import. This is particularly sensitive for `xtquant`, because the documented environment connects the package to a local QMT/miniQMT client capable of reading financial information, submitting securities orders, and initiating account operations. This finding does not establish that the current packages are malicious. The vulnerability is the absence of controls ensuring that future installations resolve to the versions that were reviewed. ### Attack Path 1. An attacker compromises the package publishing account, package distribution channel, or an allowed future dependency release. 2. The attacker publishes a version satisfying `xtquant>=1.0.0` or `pandas>=1.5.0`. 3. A user follows the documented command and installs dependencies without a lockfile or hash verification. 4. The package manager resolves the compromised release. 5. Malicious code executes during installation or when the package is imported. 6. If executed on the trading workstation, the malicious package may interact with accessible local files, the Python process, network resources, or an authenticated QMT/miniQMT environment. ### Impact Asses ...[truncated 741 chars]- Remediation
View remediation
pandas== ``` 2. Generate and commit a lockfile containing transitive dependency versions. 3. Require package hashes, such as with a hash-locked requirements file and `pip install --require-hashes`. 4. Record the canonical package repository and publisher identity in project metadata. 5. Install dependencies inside an isolated virtual environment using a non-administrative account. 6. Perform dependency updates through a controlled review process that includes provenance verification, vulnerability scanning, and functional testing. 7. Separate market-data workloads from live-trading workloads where possible. 8. Prevent newly installed or unreviewed packages from running while a live trading session is authenticated. ]]>