T08 · Insecure Dependencies
Warning
- Location
SKILL.md:24- Finding
Unpinned Third-Party Package Installation
- Content
View full analysis
- Remediation
View remediation
``` Install it with mandatory hash checking: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Generate the hash from a trusted, independently verified release artifact. Do not copy a hash from the same potentially compromised distribution channel without additional verification. 4. Publish verifiable provenance for release artifacts and document the authoritative package publisher, repository, and package-index location. 5. Ensure that the published package is reproducibly tied to the reviewed source revision. Prefer signed tags, signed releases, build attestations, and reproducible builds. 6. In controlled deployments, install the reviewed local source or a trusted internally mirrored artifact instead of resolving a mutable public package name. 7. Configure pip to use only approved indexes and avoid combining trusted private indexes with untrusted public indexes in a way that permits dependency confusion. 8. Perform installation and execution as an unprivileged user inside an isolated virtual environment or container. Do not run the installation command as root or with unnecessary administrative permissions. ]]>