T08 · Insecure Dependencies
Warning
- Location
SKILL.md:52- Finding
Unpinned Third-Party Dependencies Create a Supply-Chain Risk
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:52-56
Vulnerability Type: Unpinned dependency installation
Risk Level: MediumVulnerable Code
bash ## Installation ```bash pip install tushare akshare pandas numpytext ### Technical Analysis The installation instructions install four third-party packages without fixed versions, integrity hashes, a lock file, or a specified trusted package index. Consequently, the versions installed depend on the package-index state at installation time and may change without any modification to this project. Python package installation and subsequent imports can execute package-controlled code with the privileges of the user running the installation or application. If a package release or its distribution account is compromised, following these instructions could introduce malicious code into the environment. The runtime also passes the configured Tushare token to the imported Tushare package, increasing the potential effect of a compromised dependency. The audited project does not itself demonstrate dependency confusion, typosquatting, or a currently compromised package. The confirmed weakness is the absence of dependency pinning and integrity controls. ### Attack Path 1. An attacker compromises an upstream dependency, its publisher account, or the package distribution channel. 2. The attacker publishes a malicious release under one of the dependency names. 3. A user follows the documented `pip install` command without version or hash constraints. 4. The package resolver selects and installs the malicious release. 5. Package installation hooks or imported package code execute in the user's environment. 6. The malicious dependency can access data available to that process, potentially including the `TUSHARE_TOKEN`, local files readable by the user, and application-supplied market data. ### Impact Assessment Successful exploitation would execute depen ...[truncated 459 chars]- Remediation
View remediation
Remediation Suggestions
- Create a reviewed dependency manifest with exact versions, such as:
text tushare==REVIEWED_VERSION akshare==REVIEWED_VERSION pandas==REVIEWED_VERSION numpy==REVIEWED_VERSION - Generate and verify cryptographic hashes for every direct and transitive dependency, using a hash-enforcing installer workflow such as
pip install --require-hashes. - Commit a lock file generated from reviewed package versions and update it through a controlled dependency-review process.
- Install packages inside a dedicated virtual environment or container under a non-privileged account.
- Explicitly configure an approved HTTPS package index and prevent fallback to untrusted indexes.
- Run software-composition analysis and vulnerability checks in CI before dependency updates are accepted.
- Avoid exposing production credentials during dependency installation or import-time initialization, and use a narrowly scoped Tushare token where supported.
- Create a reviewed dependency manifest with exact versions, such as: