T08 · Insecure Dependencies
Note
- Location
- README.md:117
- Finding
- Unpinned Third-Party Dependency Allows Supply-Chain Substitution## Vulnerability Details **File Location**: `README.md:117-120` **Additional Location**: `CLAUDE.md:37` **Vulnerability Type**: Unpinned dependency without integrity verification **Risk Level**: Low ### Vulnerable Code Snippet ```markdown ## Dependencies ```bash pip install requests ``` ``` The same installation approach is also documented in `CLAUDE.md`: ```markdown Only dependency: `pip install requests` ``` The package is subsequently loaded by `scripts/miner.py:29`: ```python import requests ``` ### Technical Analysis The installation instructions retrieve the latest package matching the name `requests` from whichever Python package index is configured in the user's environment. The project does not provide a pinned version, lock file, verified artifact hash, or index restriction. Consequently, installation is not reproducible and does not cryptographically bind the dependency to a reviewed artifact. An attacker who compromises the configured package repository, a future package release, a package mirror, or dependency-resolution configuration could cause users to install code that was not included in this audit. This is a supply-chain weakness rather than evidence that the current `requests` package is malicious. The package name is legitimate and not a visible typosquat, so practical exploitation requires compromise or manipulation of dependency resolution. ### Attack Path 1. An attacker compromises a configured Python package index, mirror, package release, or the victim's dependency-resolution configuration. 2. The attacker makes a malicious or modified `requests` distribution the version selected by the unpinned installation command. 3. A user follows the documented command: ```bash pip install requests ``` 4. Malicious build hooks may execute during installation, or malicious package code executes when `scripts/miner.py` imports `requests`. 5. The payload runs with the privileges of the user executing `pip` or the miner. ### ...[truncated 719 chars]
- Remediation
- ## Remediation Suggestions 1. Create a dependency file containing an explicitly reviewed version: ```text requests==<reviewed-version> ``` 2. Generate and verify hashes for the approved distribution, then require hash checking: ```text requests==<reviewed-version> \ --hash=sha256:<verified-distribution-hash> ``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Pin all transitive dependencies as well, preferably through a reviewed lock file generated by a tool such as `pip-tools`. 4. Use the official Python Package Index or an organization-controlled repository explicitly configured with TLS and access controls. 5. Add automated dependency scanning and scheduled review of pinned versions so security updates can be adopted deliberately. 6. Update `README.md` and `CLAUDE.md` to reference the locked dependency installation procedure instead of `pip install requests`.