T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:77
- Finding
- Unpinned Third-Party Dependencies Create a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:77-79`; related imports in `scripts/screen_stocks.py:14-16` **Vulnerability Type**: Unpinned and integrity-unverified Python dependencies **Risk Level**: Medium **Vulnerable installation command:** ```bash pip install akshare pandas numpy ``` **Related dependency imports:** ```python import akshare as ak import pandas as pd import numpy as np ``` ### Technical Analysis The documented installation command retrieves the latest available releases of three third-party packages without exact version constraints, cryptographic hashes, a lockfile, or an explicitly trusted package index. Consequently, the dependency code installed for two different users or at two different times may differ from the code reviewed during this audit. Python packages can execute package-controlled code during installation and import. The application imports all three dependencies at startup, so a compromised upstream release, compromised package repository, dependency-resolution attack, or malicious transitive dependency could execute arbitrary Python code with the privileges of the user running the screener. No evidence indicates that the currently named packages are malicious. The vulnerability is the absence of controls ensuring that users install the same reviewed artifacts. ### Attack Path 1. An attacker compromises a direct or transitive dependency release, its maintainer account, or the package distribution channel. 2. The attacker publishes a malicious release under a dependency name accepted by the unrestricted installation command. 3. A user follows the documented `pip install akshare pandas numpy` instruction. 4. Pip resolves and installs the attacker-controlled release because no approved version or artifact hash is enforced. 5. The user starts `scripts/screen_stocks.py`. 6. Malicious package initialization or import code executes under the invoking user's account. # ...[truncated 639 chars]
- Remediation
- ## Remediation Suggestions 1. Define exact, reviewed direct and transitive dependency versions in a lockfile generated by a reproducible dependency-management tool. 2. Require cryptographic hashes for every distributed artifact, for example through a fully pinned requirements file used with `pip install --require-hashes`. 3. Configure installations to use an explicitly trusted package index or an internally controlled artifact repository. 4. Install dependencies in an isolated virtual environment under a non-privileged account; do not recommend administrative or root installation. 5. Add automated dependency vulnerability and provenance checks to the release process. 6. Review dependency updates before changing pins, regenerate hashes in a controlled environment, and publish the updated lockfile with the project. 7. Replace the installation documentation with a controlled command such as: ```bash python -m pip install --require-hashes -r requirements.txt ```