T08 · Insecure Dependencies
Error
- Location
requirements.txt:1- Finding
Unpinned Security-Critical Wallet Dependency
- Content
View full analysis
None: """Install dependencies from requirements.txt.""" if not REQ_FILE.exists(): error(f"requirements.txt not found at {REQ_FILE}") error("Create it with: kaspa") raise FileNotFoundError(str(REQ_FILE)) # Set pip cache directory pip_cache = ROOT / ".pip-cache" os.environ["PIP_CACHE_DIR"] = str(pip_cache) log("Installing dependencies...") pip_cmd = [str(venv_python), "-m", "pip", "install", "--upgrade", "pip"] try: run_command(pip_cmd, capture=True) except subprocess.CalledProcessError: log("Warning: Could not upgrade pip, continuing anyway...") pip_install = [str(venv_python), "-m", "pip", "install", "-r", str(REQ_FILE)] try: run_command(pip_install) except subprocess.CalledProcessError as e: ``` ### Technical Analysis The `kaspa` dependency has no exact version constraint or package hash. Every new installation can therefore retrieve whichever release currently satisfies the unrestricted package name. The installer also automatically upgrades `pip` without pinning its version. This dependency is security-critical rather than an isolated utility. The wallet passes mnemonic phrases and private keys into APIs imported from this package and uses it to derive keys, construct transactions, sign payments, and communicate with Kaspa nodes. Consequently, the effective trusted codebase can change after the project itself has been reviewed. No evidence establishes that the current `kaspa` package is malicious. The vulnerability is the absence of controls that prevent a compromised, malicious, or incompatib ...[truncated 1396 chars]- Remediation
View remediation