T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:80
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:80-84` **Related Runtime Import**: `scripts/transform_coords.py:13-18` **Vulnerability Type**: Unpinned and unverifiable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Dependency Installation ```bash pip3 install pyproj ``` ``` The installed dependency is subsequently imported by the application: ```python try: from pyproj import Transformer except ImportError: sys.exit(1) ``` ### Technical Analysis The installation instructions retrieve the latest version of `pyproj` selected by the active Python package index without specifying an audited version, verifying package hashes, using a lockfile, or requiring an isolated environment. This creates a mutable and non-reproducible software supply-chain boundary. The audit found no evidence that `pyproj` itself is malicious. The confirmed weakness is the unsafe dependency-management pattern. If the package publisher account, configured package index, package artifact, or dependency-resolution environment is compromised, a substituted distribution can execute attacker-controlled code during installation or when the application imports the package. ### Attack Path 1. An attacker compromises a configured Python package index, publisher account, distribution artifact, or local package-resolution configuration. 2. The user follows the documented `pip3 install pyproj` command. 3. Because no version or artifact hash is specified, pip resolves and installs the attacker-controlled or compromised release. 4. Malicious package installation hooks or import-time code execute when the package is installed or imported by `transform_coords.py`. 5. The payload runs with the permissions of the user who invoked pip or the coordinate-conversion script. This path requires compromise or manipulation of the dependency supply chain; the reviewed project does not indepen ...[truncated 648 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `pyproj` to a reviewed, supported version rather than resolving an unrestricted latest release. 2. Place the dependency in a version-controlled requirements or lock file. 3. Require cryptographic hashes, for example through a hash-locked requirements file and `pip install --require-hashes`. 4. Install dependencies inside a dedicated virtual environment rather than the system Python environment. 5. Configure an explicitly trusted package index and avoid untrusted extra indexes that could introduce dependency-confusion risks. 6. Periodically review and update the pinned version after vulnerability and provenance checks. 7. Document a reproducible installation command, such as: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ```