T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unnecessary and Unpinned PyPI Dependencies Create a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-2` and `SKILL.md:256-259` **Vulnerability Type**: Unpinned and unnecessary third-party dependencies **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1-2`: ```text dataclasses enum ``` `SKILL.md:256-259`: ```bash # Python dependencies pip install -r requirements.txt ``` ### Technical Analysis The project requires Python 3.8 or later and describes itself as a pure standard-library implementation. Both `dataclasses` and `enum` are included in supported Python versions, so installing packages with these names from PyPI is unnecessary. Neither dependency is pinned to a verified version or protected with an integrity hash. Consequently, executing the documented installation command resolves mutable third-party artifacts at installation time. This unnecessarily expands the project's supply-chain attack surface and makes the installed code dependent on the state of an external package repository at the time of installation. Python package installation may execute package build hooks or other installation-time code. If an unnecessary package, one of its releases, or its distribution channel were compromised, that code would execute with the privileges of the user running `pip`. ### Attack Path 1. A user follows the prerequisite instructions in `SKILL.md`. 2. The user runs `pip install -r requirements.txt`. 3. `pip` resolves the unpinned `dataclasses` and `enum` package names from its configured package index. 4. A compromised, substituted, or unexpectedly changed distribution is downloaded. 5. Package installation logic executes under the installing user's account. 6. The malicious package could access files, credentials, and network resources available to that account. This attack path depends on compromise or substitution of a dependency or package source; the audit did not find evidence that the currently referenced packages are themselves malicious. ### Impact Assessmen ...[truncated 576 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove both entries from `requirements.txt`, because Python 3.8 and later provide `dataclasses` and `enum` in the standard library. 2. Remove the unnecessary `pip install -r requirements.txt` prerequisite or explicitly state that no third-party installation is required. 3. If support for an older Python version is genuinely needed, use the correct, reviewed backport packages only for those versions. 4. Pin every necessary third-party dependency to an approved version. 5. Add cryptographic hashes using a locked dependency file and install with hash verification, for example: ```bash pip install --require-hashes -r requirements.lock ``` 6. Perform dependency vulnerability and provenance checks in CI. 7. Avoid running package installation with administrator or root privileges. ]]>