T08 · Insecure Dependencies
Warning
- Location
scripts/install.sh:16- Finding
Unpinned Third-Party Dependencies Installed from a Mutable Package Index
- Content
View full analysis
/dev/null; then PIP=pip3 elif command -v pip &>/dev/null; then PIP=pip else echo "pip was not found; install Python 3 first" exit 1 fi $PIP install rembg Pillow numpy onnxruntime --quiet ``` The corresponding manual installation instruction is: ```bash pip install rembg Pillow numpy onnxruntime ``` ### Technical Analysis The installation script requests `rembg`, `Pillow`, `numpy`, and `onnxruntime` without pinning reviewed versions or validating package hashes. Pip therefore resolves the package versions and their transitive dependencies from the configured package index at installation time. The effective installed code can change after this Skill has been reviewed. Python packages may execute build or installation logic during installation. If an upstream package or transitive dependency is compromised, a malicious release is published, or the configured package index is untrusted, installation can execute attacker-controlled code. No evidence indicates that the package names in this project are typosquatted or currently malicious; the risk arises from the mutable and unverified dependency resolution process. The script also selects the first `pip3` or `pip` executable found through `PATH` and does not create an isolated virtual environment. This can cause dependencies to be installed into an unintended Python environment and may permit a spoofed local pip executable to be invoked when the caller's `PATH` is already compromised. ### Attack Path 1. An attacker compromises a direct or transitive dependency, publishes a malicious version through an accepted package source, or controls a package index configured in the use ...[truncated 1215 chars]- Remediation
View remediation