T08 · Insecure Dependencies
Warning
- Location
- scripts/qr.py:11
- Finding
- Unpinned Third-Party Dependency Installation Guidance## Vulnerability Details **File Location**: `scripts/qr.py:11-15` and `scripts/qr.py:44-49` **Vulnerability Type**: Unpinned third-party dependencies and unsafe supply-chain guidance **Risk Level**: Medium The script instructs users to install third-party packages directly from the default Python package index without specifying reviewed versions, cryptographic hashes, or a locked dependency manifest. ```python try: import qrcode except ImportError: print("Error: qrcode not installed", file=sys.stderr) print("Install with: pip install qrcode[pil]", file=sys.stderr) sys.exit(1) ``` ```python try: from PIL import Image from pyzbar.pyzbar import decode except ImportError: print("Error: Required libraries not installed", file=sys.stderr) print("Install with: pip install pillow pyzbar", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis Commands such as `pip install qrcode[pil]` and `pip install pillow pyzbar` resolve mutable package releases from the user's configured package index. The project provides no dependency lockfile, exact version constraints, package hashes, or documented provenance verification. This does not prove that the named packages are malicious. However, the installation workflow lacks controls against a compromised upstream release, unsafe future release, package-index substitution, or malicious package returned through an untrusted index configuration. Python packages may run build or installation logic and subsequently execute with the privileges of the user running this tool. ### Attack Path 1. An attacker compromises a referenced package, its maintainer account, its distribution channel, or an index configured in the victim's Python environment. 2. The victim runs the skill without the required dependency installed. 3. The script displays an unrestricted `pip install` command. 4. The victim follows that instruction. 5. `pip` retrieves ...[truncated 788 chars]
- Remediation
- ## Remediation Suggestions 1. Add a reviewed dependency manifest containing exact package versions. 2. Generate and commit cryptographic hashes for all direct and transitive distributions. 3. Install dependencies using a hash-enforcing command such as: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Prefer a lockfile generated through a dependency-management process that records transitive dependencies. 5. Review and update pinned dependencies through a controlled process that includes vulnerability and provenance checks. 6. Instruct users to install dependencies inside an isolated virtual environment rather than a global or privileged Python environment. 7. Avoid directing users to run package installation as an administrator or root user.