T08 · Insecure Dependencies
- Location
README.md:117- Finding
Unpinned Third-Party Dependency Allows Supply-Chain Substitution
- Content
View full analysis
Vulnerability Details
File Location:
README.md:117-120
Additional Location:CLAUDE.md:37
Vulnerability Type: Unpinned dependency without integrity verification
Risk Level: LowVulnerable Code Snippet
markdown ## Dependencies ```bash pip install requeststext The same installation approach is also documented in `CLAUDE.md`: ```markdown Only dependency: `pip install requests`The package is subsequently loaded by
scripts/miner.py:29:python import requestsTechnical Analysis
The installation instructions retrieve the latest package matching the name
requestsfrom whichever Python package index is configured in the user's environment. The project does not provide a pinned version, lock file, verified artifact hash, or index restriction.Consequently, installation is not reproducible and does not cryptographically bind the dependency to a reviewed artifact. An attacker who compromises the configured package repository, a future package release, a package mirror, or dependency-resolution configuration could cause users to install code that was not included in this audit.
This is a supply-chain weakness rather than evidence that the current
requestspackage is malicious. The package name is legitimate and not a visible typosquat, so practical exploitation requires compromise or manipulation of dependency resolution.Attack Path
-
An attacker compromises a configured Python package index, mirror, package release, or the victim's dependency-resolution configuration.
-
The attacker makes a malicious or modified
requestsdistribution the version selected by the unpinned installation command. -
A user follows the documented command:
bash pip install requests -
Malicious build hooks may execute during installation, or malicious package code executes when
scripts/miner.pyimportsrequests. -
The payload runs with the privileges of the user executing
pipor the miner.
...[truncated 719 chars]
-
- Remediation
View remediation
Remediation Suggestions
-
Create a dependency file containing an explicitly reviewed version:
text requests==<reviewed-version> -
Generate and verify hashes for the approved distribution, then require hash checking:
text requests==<reviewed-version> \ --hash=sha256:<verified-distribution-hash>Install it with:
bash python -m pip install --require-hashes -r requirements.txt -
Pin all transitive dependencies as well, preferably through a reviewed lock file generated by a tool such as
pip-tools. -
Use the official Python Package Index or an organization-controlled repository explicitly configured with TLS and access controls.
-
Add automated dependency scanning and scheduled review of pinned versions so security updates can be adopted deliberately.
-
Update
README.mdandCLAUDE.mdto reference the locked dependency installation procedure instead ofpip install requests.
-