T08 · Insecure Dependencies
- Location
scripts/install_deps.sh:9- Finding
Unpinned Dependency Installation with Unconditional Global Upgrades
- Content
View full analysis
Vulnerability Details
File Location:
scripts/install_deps.sh, line 9
Vulnerability Type: Unpinned third-party dependencies and unsafe environment-wide upgrades
Risk Level: MediumVulnerable Code
bash echo "Installing MLX + inference deps (requires Apple Silicon macOS)..." pip install --upgrade mlx mlx-lm transformersThe related documentation also recommends unpinned installation of optional server dependencies at
SKILL.md, line 87:bash pip install fastapi uvicorn[standard]Technical Analysis
The installation script retrieves mutable package versions and their transitive dependencies from the active Python package index. It neither pins exact versions nor verifies package hashes. The
--upgradeoption may also replace packages in the user's current Python environment, rather than limiting changes to an isolated environment.Python package installation can execute package build and installation logic. Consequently, a compromised upstream release, malicious package-index configuration, dependency-confusion condition, or compromised transitive dependency could execute code under the invoking user's account. Even without a malicious package, an incompatible future release could alter audited behavior or break other software in the same environment.
This finding concerns the installation process. No evidence was found that the currently named packages are malicious.
Attack Path
- An attacker compromises a named or transitive package release, or influences the package index used by
pip. - A user follows the documented Quick Start and runs
bash scripts/install_deps.sh. - Line 9 invokes
pip install --upgradewithout version or hash constraints. pipdownloads the attacker-controlled or otherwise unaudited package version and executes its installation logic.- The payload runs with the permissions of the user who launched the installer and may modify that us ...[truncated 630 chars]
- An attacker compromises a named or transitive package release, or influences the package index used by
- Remediation
View remediation
Remediation Suggestions
- Pin all direct and transitive dependencies to reviewed versions in a lock file.
- Generate and verify cryptographic hashes, and install with
pip install --require-hashes. - Create and use a dedicated virtual environment instead of modifying the active environment.
- Remove the unconditional
--upgradebehavior. - Configure and document a trusted package index.
- Apply equivalent version and hash controls to the optional FastAPI and Uvicorn dependencies.
- Periodically review and intentionally update the lock file after security and compatibility testing.