T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:4
- Finding
- Unpinned and Unverified Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:4-16`; installation instruction at `SKILL.md:30-33` **Vulnerability Type**: Supply-chain risk caused by open-ended dependency versions and missing integrity verification **Risk Level**: Medium ### Vulnerable Code `requirements.txt:4-16`: ```text # Data source libraries akshare>=1.10.0 baostock>=0.8.8 requests>=2.28.0 # Data processing pandas>=1.5.0 numpy>=1.21.0 # Configuration pyyaml>=6.0 # Type hints typing-extensions>=4.0.0 ``` `SKILL.md:30-33`: ```bash pip install -r requirements.txt ``` ### Technical Analysis Every dependency uses an open-ended minimum-version constraint. Consequently, installation may select any newer release available from the configured package index rather than a specific version reviewed with this project. The project does not provide a lock file, package hashes, or an integrity-enforcing installation command. Python package installation can execute package build or installation logic. If an accepted upstream version or the configured package index is compromised, following the documented installation command may introduce and execute attacker-controlled code. Unrestricted upgrades can also introduce unreviewed transitive dependencies. `pyyaml` and `typing-extensions` were not observed in the reviewed runtime imports, so they may unnecessarily expand the dependency and supply-chain attack surface. This finding does not establish that the currently named packages are malicious. The vulnerability is the absence of reproducible version and integrity controls. ### Attack Path 1. An attacker compromises an upstream dependency account, publishing infrastructure, package-index path, or a transitive dependency. 2. The attacker publishes a malicious release whose version satisfies one of the `>=` constraints. 3. A user follows the instruction in `SKILL.md` and runs `pip install -r requirements.txt`. 4. Pip resolves the compromised release because no exact ver ...[truncated 848 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace open-ended constraints with exact versions that have been reviewed and tested, for example `package==X.Y.Z`. 2. Generate a reproducible lock file containing hashes for all direct and transitive dependencies. 3. Require integrity verification during installation, such as: ```bash python -m pip install --require-hashes -r requirements.lock ``` 4. Remove dependencies that are not required by runtime or development code, particularly `pyyaml` and `typing-extensions` if confirmed unused. 5. Separate runtime, development, and test dependencies into distinct locked files. 6. Install dependencies inside an isolated virtual environment using a non-privileged account. 7. Review dependency updates through a controlled process that includes vulnerability scanning, provenance checks, test execution, and lock-file regeneration. 8. Configure trusted package indexes explicitly and avoid unreviewed mirrors or supplemental indexes that could enable dependency confusion. ]]>