T08 · Insecure Dependencies
Warning
- Location
install.sh:57- Finding
Unpinned Dependencies Permit Supply-Chain Code Execution
- Content
View full analysis
/dev/null; then yum install -y ffmpeg ``` ```bash "$VENV_DIR/bin/pip" install --upgrade pip "$VENV_DIR/bin/pip" install openai-whisper ``` ### Technical Analysis The installation script retrieves `ffmpeg`, `pip`, `openai-whisper`, and their transitive dependencies without exact version constraints, package hashes, or a reviewed lock file. Consequently, identical executions of the installer can resolve to different code over time. Package installation is an executable-code boundary. Python packages may execute build backends or installation hooks, while operating-system packages execute package-maintainer scripts. The risk is amplified because the script uses `/root` paths and invokes system package managers, indicating that it is intended to be run with elevated privileges. No malicious package or compromised repository is present in the audited project. The vulnerability is the absence of controls that would contain an upstream package compromise, malicious release, dependency-confusion event, or unexpected dependency update. ### Attack Path 1. An attacker compromises a package repository, an upstream dependency, a maintainer account, or the dependency-resolution path. 2. The attacker publishes or substitutes a malicious version of `openai-whisper`, `pip`, `ffmpeg`, or a transitive dependency. 3. An administrator runs `install.sh`. 4. The unrestricted package commands resolve and download the attacker-controlled version. 5. Package build, installation, import, or maintainer code executes with the privileges of the installer. 6. If the installer is running as root, the malicious dependency can modify system files, access root-readable data, install persistence, or compromise ...[truncated 663 chars]- Remediation
View remediation