T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned Third-Party Dependencies Create a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-3`; installation occurs in `.github/workflows/ci.yml:18-20` and is documented in `SKILL.md:40-42` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1-3`: ```text requests>=2.28.0 python-dotenv pytest>=7.0.0 ``` `.github/workflows/ci.yml:18-20`: ```yaml - name: Install dependencies run: | python -m pip install --upgrade pip pip install -r requirements.txt ``` `SKILL.md:40-42`: ```text 1. Install dependencies - pip install -r requirements.txt (The script uses requests and python-dotenv; keep requirements minimal.) ``` ### Technical Analysis The project installs packages directly from the configured Python package index without exact version pins or integrity hashes. `python-dotenv` has no version constraint, while `requests>=2.28.0` and `pytest>=7.0.0` permit any later release satisfying the lower bound. Consequently, the code reviewed during this audit is not sufficient to determine the code that will execute during a future installation. A newly published, compromised, or otherwise unsafe dependency version could be selected automatically. Python package installation may execute build-system code, and imported dependency code executes with the privileges of the user or CI runner. No evidence was found that the currently named packages are malicious or that dependency confusion or typosquatting is presently occurring. The vulnerability is the absence of reproducible dependency resolution and artifact integrity controls. ### Attack Path 1. An upstream dependency release or its distribution account is compromised, or an unsafe future release is published. 2. A user or CI job runs `pip install -r requirements.txt`. 3. Pip resolves the mutable constraints to the affected release because exact versions and hashes are absent. 4. Malicious build hooks may execute during installation, or malicious package cod ...[truncated 749 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin all direct and transitive dependencies to reviewed versions using a lockfile generated by a tool such as `pip-tools`, Poetry, or uv. 2. Install with hash verification, for example: ```bash pip install --require-hashes -r requirements.lock ``` 3. Separate runtime dependencies from development dependencies so end users do not need to install `pytest`. 4. Use automated dependency scanning and controlled update pull requests. 5. Review dependency release notes and artifact provenance before updating pins. 6. In CI, install from the reviewed lockfile rather than directly from mutable constraints. 7. Restrict CI token permissions and avoid exposing secrets to dependency-installation steps. ]]>