T08 · Insecure Dependencies
- Location
README.md:31- Finding
Unpinned Third-Party Dependency Receives Reusable X Authentication Cookies
- Content
View full analysis
Vulnerability Details
File Locations:
README.md:17README.md:31-35scripts/tweety_utils.py:12-33
Vulnerability Type: Unverified supply-chain dependency with access to sensitive authentication material
Risk Level: MediumComplete Code Snippets
From
README.md:17:markdown - tweety-ns library (`pip3 install tweety-ns`)From
README.md:31-35:markdown 2. Install dependencies: ```bash pip3 install tweety-ns- Set up Twitter cookies at
<WORKSPACE>/config/twitter_cookies.json
text From `scripts/tweety_utils.py:12-33`: ```python def load_cookies_file(cookies_path): """Load cookies dict from a JSON file.""" if not os.path.exists(cookies_path): sys.stderr.write(f"Error: cookie file not found: {cookies_path}\n") sys.exit(1) with open(cookies_path, "r", encoding="utf-8") as f: return json.load(f) def create_app(session_dir): """Create a tweety Twitter client with session storage.""" from tweety import Twitter os.makedirs(session_dir, exist_ok=True) session_path = os.path.join(session_dir, "tw_session") return Twitter(session_path) def login_app(app, cookies_dict): """Login to Twitter via cookies. Exits on failure.""" try: app.load_cookies(cookies_dict) except Exception as e: sys.stderr.write(f"Error: login failed: {e}\n") sys.exit(2)Technical Analysis
The installation instructions use
pip3 install tweety-nswithout an exact version pin, lock file, package hash, or documented provenance check. The importedtweetypackage subsequently executes in the Agent's Python process and receives reusable X/Twitter authentication cookies throughapp.load_cookies(cookies_dict).Authenticated X access is necessary for the declared profile-analysis functionality. However, allowing the latest mutable release of an unverified dependency to process authentication cookies creates a supply-chain trust boundary ...[truncated 2381 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin an exact reviewed package version
- Replace the floating installation command with an exact approved version, such as
tweety-ns==X.Y.Z. - Update the version only after reviewing release changes.
- Replace the floating installation command with an exact approved version, such as
-
Enforce cryptographic integrity
- Maintain a locked requirements file containing hashes.
- Install with
pip install --require-hashes -r requirements.txt. - Pin and hash transitive dependencies as well as the direct dependency.
-
Document and verify provenance
- Record the expected package index, upstream repository, maintainer identity, and reviewed source revision.
- Configure installation to use an explicitly trusted package index rather than unspecified or user-controlled indexes.
- Consider building and hosting an internally reviewed wheel.
-
Reduce credential scope
- Use a dedicated X account for analysis instead of cookies from a primary account.
- Grant only the minimum account capabilities required for read-only profile collection where the platform permits it.
- Rotate cookies after suspected dependency compromise and avoid long-lived sessions.
-
Isolate dependency execution
- Run collection in a dedicated virtual environment or sandbox.
- Restrict filesystem access to the cookie file, output directory, and required session directory.
- Apply outbound-network controls so the process can communicate only with necessary X endpoints.
- Do not expose unrelated workspace secrets or credentials to the process.
-
Protect session material
- Create cookie and session files with restrictive owner-only permissions.
- Validate that the configured paths do not point to shared or attacker-controlled directories.
- Avoid logging cookie values and sanitize dependency exceptions before exposing them to broader logs.
-
Prefer a supported, least-privilege interface
- Where practical, use an official, narrowly scoped, read-only API credential instead ...[truncated 29 chars]
-