T08 · Insecure Dependencies
Warning
- Location
scripts/requirements.txt:4- Finding
Unpinned Third-Party Python Dependencies
- Content
View full analysis
=1.2.0 lunar_python>=1.4.0 ``` The related installation instruction is also exposed through `scripts/bazi_chart.py:633`: ```python raise ValueError("Lunar calendar charting requires the lunar_python library. Install it first: pip install lunar_python") ``` ### Technical Analysis The dependency declarations use minimum-version constraints rather than exact, reviewed versions. Consequently, installation may resolve to any future version of `lunardate` or `lunar_python`. No integrity hashes or lock file constrain the downloaded artifacts. These packages are imported directly by the chart-generation scripts. Python executes package initialization code during import, so a compromised dependency release could run arbitrary code before the legitimate calculation logic begins. There is no evidence that the currently named packages or bundled project code are malicious. The issue is a supply-chain exposure caused by uncontrolled dependency selection and the absence of artifact integrity verification. ### Attack Path 1. An attacker compromises a dependency maintainer account, package publishing infrastructure, or a future permitted package release. 2. The attacker publishes a malicious version whose number satisfies `lunardate>=1.2.0` or `lunar_python>=1.4.0`. 3. A user follows the documented `pip install` instruction without using a trusted lock file or hashes. 4. The package manager selects and installs the compromised release. 5. A chart script imports the dependency. 6. Malicious package initialization code executes with the privileges of the user running the script. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the invoking user's account. The ...[truncated 392 chars]- Remediation
View remediation
lunar_python== ``` 2. Generate a reproducible lock file containing cryptographic hashes for every direct and transitive dependency, such as with `pip-compile --generate-hashes`. 3. Install with hash enforcement: ```bash pip install --require-hashes -r requirements.lock ``` 4. Use an authenticated, explicitly configured package index or an internally controlled dependency mirror. 5. Review package ownership, release history, source repository, and artifact provenance before approving upgrades. 6. Automate dependency vulnerability and integrity monitoring while keeping version changes subject to review. 7. Run these scripts in a least-privileged virtual environment or container without unnecessary secrets, sensitive mounts, or elevated host permissions. 8. Update the installation guidance in `scripts/bazi_chart.py` to direct users to the reviewed lock file rather than an unconstrained package installation command. ]]>