T08 · Insecure Dependencies
- Location
package.json:15- Finding
Mutable and ecosystem-mismatched third-party dependencies create supply-chain risk
- Content
View full analysis
Vulnerability Details
File Location:
package.json:15-21
Supporting Locations:SKILL.md:147-164,scripts/query_contract_expiry.py:32-36
Vulnerability Type:T08: Insecure Dependencies
Risk Level: MediumVulnerable Code
json "dependencies": { "shwuyeyanjiu": ">=1.0.0", "requests": ">=2.31.0", "beautifulsoup4": ">=4.12.0", "pdf2image": ">=1.16.0", "pytesseract": ">=0.3.10", "python-dateutil": ">=2.8.0" },Technical Analysis
The project declares Python dependency names in
package.json, whose dependency entries are ordinarily resolved from the npm ecosystem. An npm client will not interpret these entries as Python packages from PyPI. It may instead install unrelated npm packages that happen to use the same names, creating an ecosystem-confusion risk.Every dependency also uses an open-ended lower-bound constraint. For example,
">=1.0.0"permits any future version satisfying the constraint. Without an integrity-protected lockfile, exact version pins, or package hashes, dependency behavior can change after the project has been reviewed.The advertised contract-analysis implementation is not present in this artifact. Documentation and the wrapper script direct users to execute
batch_extract_dates_v2.pyfrom the separately installedshwuyeyanjiuskill. Consequently, the principal executable responsible for network requests, PDF processing, OCR, and output generation is outside the reviewed package.The local wrapper only prints the suggested command and does not automatically download or execute the external script. Exploitation therefore requires the user or an installation process to resolve the declared dependencies or follow the documented execution instructions.
Attack Path
- A user runs an npm-compatible installation command against this project or otherwise installs the declared dependencies.
- The package manager resolves dependency names fr ...[truncated 1281 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove Python package names from
package.json. Declare them through a Python-native manifest such aspyproject.tomlorrequirements.txt. - Pin dependencies to reviewed exact versions and commit an integrity-protected lockfile. Where supported, require hashes for downloaded distributions.
- Verify package names, publishers, source repositories, and distribution hashes before installation.
- Ship the actual contract-query implementation in this repository so that its network, parsing, OCR, file-handling, and output behavior can be audited.
- If
shwuyeyanjiumust remain external, pin it to a verified immutable version or commit, validate its integrity before execution, and clearly identify the expected package ecosystem and publisher. - Remove the unused
sys.path.insertoperation fromscripts/query_contract_expiry.py:17, or replace it with a normal import from an explicitly installed and verified Python package. - Add automated dependency scanning and lockfile verification to the release process.
- Remove Python package names from