T08 · Insecure Dependencies
Warning
- Location
- README.md:83
- Finding
- Unpinned Third-Party Dependencies Allow Supply-Chain Code Execution## Vulnerability Details **File Location**: `README.md:83-86`; related runtime imports at `scripts/market_panels.py:29-32` and `scripts/market_panels.py:220-225` **Vulnerability Type**: Unpinned and integrity-unverified third-party dependencies **Risk Level**: Medium ### Vulnerable Code `README.md:83-86`: ```markdown #### 1) Install optional dependencies ```bash pip install finshare akshare ``` ``` `scripts/market_panels.py:29-32`: ```python try: import akshare as ak # type: ignore except Exception: # noqa: BLE001 ak = None ``` `scripts/market_panels.py:220-225`: ```python try: import finshare as fs # type: ignore except Exception as exc: # noqa: BLE001 return {"ok": False, "symbol": symbol, "error": f"finshare unavailable: {exc}"} ``` ### Technical Analysis The installation instructions retrieve the latest available `finshare` and `akshare` releases without version constraints, cryptographic hashes, or a lock file. The script subsequently imports and invokes these packages during normal market-data collection. The default `finshare` mode is `first`, making that dependency the preferred data provider when installed. Python packages can execute arbitrary code during installation and module initialization. Consequently, a compromised upstream release, package-index account, distribution channel, or dependency subtree could introduce executable code after this Skill has been reviewed. Future incompatible releases could also silently alter data-source behavior or return manipulated market information. The source code does not demonstrate that either current package is malicious. The confirmed issue is the absence of dependency pinning and integrity controls, which leaves runtime behavior dependent on mutable external artifacts. ### Attack Path 1. An attacker compromises the publishing account, release process, distribution path, or transitive dependency of `finshare` or `akshare`. 2. The attacker publishes a malicious or backdoored ...[truncated 1195 chars]
- Remediation
- ## Remediation Suggestions 1. Pin each dependency to a reviewed, exact version rather than installing the latest release: ```text finshare==REVIEWED_VERSION akshare==REVIEWED_VERSION ``` 2. Generate a lock file containing cryptographic hashes and require hash verification during installation, for example with: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Review and lock all transitive dependencies, not only the two direct packages. 4. Install dependencies in a dedicated virtual environment or restricted container using a non-privileged service account. 5. Configure an explicit trusted package index or an internally controlled package mirror. Avoid allowing untrusted supplemental indexes that could enable dependency confusion. 6. Keep optional providers disabled until the user explicitly enables them. In particular, consider changing the default finshare mode from `first` to `off` or requiring an explicit opt-in after installation. 7. Add automated dependency scanning, release provenance verification, and periodic review before updating locked versions. 8. Document the packages’ network behavior and ensure secrets such as `FRED_API_KEY` are not exposed to optional provider code unless required.