T08 · Insecure Dependencies
Warning
- Location
scripts/requirements.txt:3- Finding
Unpinned Third-Party Executable Dependencies
- Content
View full analysis
=0.10.14 opencv-python>=4.8.0 numpy>=1.24.0 ``` The documented installation procedure in `SKILL.md:62` executes: ```bash pip install -r scripts/requirements.txt ``` ### Technical Analysis All three executable Python dependencies specify only a minimum version. No maximum version, exact version, lock file, or cryptographic package hash is provided. Consequently, installations performed at different times may resolve to different package releases that were not reviewed with this project. Python packages can execute code during installation and when imported at runtime. If an upstream account, release process, package repository, or subsequently allowed package version is compromised, following the documented installation procedure could introduce attacker-controlled code. The package names appear legitimate, and the audit found no evidence of typosquatting or a currently malicious package. The risk arises from trusting all future versions without integrity verification. ### Attack Path 1. An attacker compromises the release process or repository account of one of the listed packages. 2. The attacker publishes a malicious version greater than or equal to the declared minimum version. 3. A user follows the documented command: `pip install -r scripts/requirements.txt`. 4. Pip resolves the malicious release because the requirement permits future versions and provides no trusted hash. 5. Malicious package code executes during installation or when the application imports the dependency. ### Impact Assessment Successfully exploited dependency compromise would execute code with the privileges of the user or service account running pip or the MediaPipe script. Depending on those privileges, the attacker could access local file ...[truncated 381 chars]- Remediation
View remediation