T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned Third-Party Dependencies Permit Unreviewed Package Updates
- Content
View full analysis
=2.26.0 typing>=3.7.4.3 ``` ### Technical Analysis Both dependencies use open-ended minimum-version constraints. Consequently, future package versions can be installed without review, making installations non-reproducible and exposing the Skill to upstream package compromise, malicious releases, or incompatible updates. The documented Python 3.6+ runtime already includes `typing` in the standard library, so installing its external backport is unnecessary and increases the dependency supply-chain surface. ### Attack Path 1. An attacker compromises an upstream dependency maintainer account, package repository, or configured package index. 2. The attacker publishes a malicious package version that satisfies the `>=` constraint. 3. A user follows the documented installation process and runs `pip install -r requirements.txt`. 4. The package manager selects the malicious version because no exact version or integrity hash is specified. 5. Malicious package code executes during installation or when the dependency is imported at runtime. This path requires compromise or substitution of an upstream package or package index; the repository itself does not contain a malicious dependency. ### Impact Assessment A compromised dependency could execute code with the privileges of the user installing or running the Skill. This may permit access to process data, files, environment variables, network resources, and credentials available to that account, including DNS API credentials supplied to the Skill at runtime. The precise scope is limited by the operating-system privileges and sandbox restrictions applied to the Skill process. ]]>- Remediation
View remediation
``` 2. Generate and commit a lock file containing transitive dependencies. 3. Record package hashes and install with `pip --require-hashes` to prevent substituted artifacts from being accepted. 4. Remove the external `typing` dependency for supported Python versions where it is part of the standard library. 5. Use a trusted package index and disable unexpected fallback indexes. 6. Add automated dependency vulnerability and integrity scanning to the release process. 7. Review and deliberately update pinned dependencies on a controlled schedule. ]]>