T08 · Insecure Dependencies
- Location
README.md:14- Finding
Unpinned Third-Party Dependencies Create a Supply-Chain Risk
- Content
View full analysis
Vulnerability Details
File Locations:
README.md:14-18README.md:120-124SKILL.md:59-63
Vulnerability Type: Unpinned and integrity-unverified Python dependencies
Risk Level: MediumComplete Vulnerable Code Snippets:
README.md:14-18:bash ### 1. 의존성 설치 ```bash pip install requests beautifulsoup4 lxmltext `README.md:120-124`: ```bash ### "의존성 설치 필요" 에러 ```bash pip install requests beautifulsoup4 lxmltext `SKILL.md:59-63`: ```bash ## 의존성 ```bash pip install requests beautifulsoup4 lxmltext ### Technical Analysis The documented installation command retrieves `requests`, `beautifulsoup4`, `lxml`, and their transitive dependencies without pinned versions, cryptographic hashes, a lockfile, or an explicitly trusted package index. Dependency resolution therefore relies on mutable package-index state and the user's local pip configuration. The listed package names are established packages and do not show evidence of typosquatting. No malicious dependency code is bundled in the audited project. Nevertheless, if a package release, transitive dependency, configured mirror, or package-index account becomes compromised, a user following these instructions could install attacker-controlled code. Python packages may execute code during installation or when imported by `scripts/search.py`. Consequently, dependency compromise can produce local code execution with the permissions of the user running pip or the shopping script. ### Attack Path 1. An attacker compromises one of the named packages, one of its transitive dependencies, or a package source configured in the victim's pip environment. 2. The attacker publishes or serves a malicious release that satisfies pip's unconstrained dependency resolution. 3. A user follows the documented command: ```bash pip install requests beautifulsoup4 lxml- pip resolves and installs the attacker-controlled package because no approved versions or hashes are enforced.
...[truncated 1014 chars]
- Remediation
View remediation
Remediation Suggestions
-
Create a dependency file containing reviewed, exact versions:
text requests==<reviewed-version> beautifulsoup4==<reviewed-version> lxml==<reviewed-version> -
Lock transitive dependencies rather than pinning only direct dependencies. Use a reproducible dependency-management tool such as
pip-tools:bash python -m pip install pip-tools pip-compile --generate-hashes requirements.in -
Require cryptographic hash verification during installation:
bash python -m pip install --require-hashes -r requirements.txt -
Review dependency updates before regenerating the lockfile, including release provenance, security advisories, and transitive dependency changes.
-
Recommend installation in an isolated virtual environment:
bash python -m venv .venv . .venv/bin/activate python -m pip install --require-hashes -r requirements.txt -
Document the intended trusted package index and advise users not to install with administrator privileges:
bash python -m pip install \ --index-url https://pypi.org/simple \ --require-hashes \ -r requirements.txt -
Replace every unpinned installation command in
README.mdandSKILL.mdwith the hardened requirements-file command so troubleshooting instructions do not reintroduce the unsafe installation path.
-