T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned and Unlocked Third-Party Dependencies Permit Non-Reproducible Installations<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-2`, `package.json:7-9`, `SKILL.md:37-45`, and `SKILL.md:112-118` **Vulnerability Type**: Third-party supply-chain risk caused by permissive version constraints and missing integrity controls **Risk Level**: Medium ### Complete Code Snippets `requirements.txt:1-2`: ```text pikepdf>=8.15.0 pillow>=10.0.0 ``` `package.json:7-9`: ```json "dependencies": { "sharp": "^0.34.4" } ``` `SKILL.md:37-45`: ```bash python3 -m pip install -r {baseDir}/requirements.txt ``` ```bash cd {baseDir} npm install ``` `SKILL.md:112-118`: ```text 4. Python deps when needed: - `pip install pikepdf` - `pip install pillow` 5. Node deps when needed: - `npm install` ``` ### Technical Analysis The documented installation workflow retrieves and installs third-party packages while allowing dependency versions to change over time: - Python uses lower-bound-only constraints (`>=`) with no upper bounds or cryptographic hashes. - npm uses a compatible version range (`^`) rather than an exact version. - No `package-lock.json` or equivalent npm lockfile was present in the audited project. - Python requirements do not include package hashes suitable for use with `pip --require-hashes`. - The fallback instructions recommend completely unpinned `pip install` commands. As a result, two users running the same documented commands at different times may install different artifacts. Package installation and subsequent package imports can execute code supplied by those dependencies, including native build steps or npm lifecycle behavior where applicable. The reviewed dependency names—`pikepdf`, `pillow`, and `sharp`—do not appear to be typosquatted or intentionally disguised. No malicious dependency source, custom registry, or deliberate remote payload was identified. The finding is therefore a supply-chain hardening weakness rather than evidence that the current dependencies are malicious. ### Attack Path 1. ...[truncated 1527 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace permissive Python constraints with reviewed exact versions, for example: ```text pikepdf==<reviewed-version> pillow==<reviewed-version> ``` 2. Generate and verify hashes for every Python package and transitive dependency. Install with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Pin Sharp to an exact reviewed version rather than using a caret range: ```json "sharp": "0.34.4" ``` 4. Generate and commit `package-lock.json`, review changes to it, and use deterministic installation: ```bash npm ci ``` 5. Replace the unpinned fallback commands in `SKILL.md` with installation commands based on the locked manifests. Avoid recommending direct commands such as `pip install pillow` without an exact version and integrity verification. 6. Use trusted, explicitly configured package registries and enforce TLS. Where feasible, use an internal package mirror containing reviewed artifacts. 7. Run dependency installation as an unprivileged user in an isolated environment or container. Do not use `sudo pip`, elevated npm installation, or accounts with access to unrelated sensitive files. 8. Add automated dependency vulnerability and provenance checks to CI, and require manual review for lockfile or package-hash changes. ]]>