T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Non-Reproducible Third-Party Dependency Installation Without Integrity Verification
- Content
View full analysis
=2.18.0,<3 ``` `SKILL.md:24-26`: ```bash pip install -r "{baseDir}/requirements.txt" python "{baseDir}/scripts/upload_to_oss.py" "/path/to/file.png" ``` ### Technical Analysis The installation instructions cause `pip` to resolve any available `oss2` release from version 2.18.0 up to, but excluding, version 3. The project does not pin a reviewed exact version and does not provide cryptographic hashes for the package or its transitive dependencies. Consequently, installation results may change over time without any modification to this project. If a future matching release, a transitive dependency, or the configured Python package index is compromised, the documented installation command may retrieve attacker-controlled code. No evidence was found that the currently declared `oss2` package is malicious. This finding concerns the lack of reproducible, integrity-verified dependency resolution rather than a confirmed malicious package. ### Attack Path 1. An attacker compromises a future compatible `oss2` release, one of its resolved transitive dependencies, or the package-index resolution path. 2. A user or Agent follows the documented command: ```bash pip install -r "{baseDir}/requirements.txt" ``` 3. `pip` selects the compromised version because it satisfies `>=2.18.0,<3`. 4. Attacker-controlled package code may run during installation or when the uploader imports and uses the dependency. 5. During uploader execution, malicious dependency code could access the process environment, including OSS credentials, and the local file selected for upload. ### Impact Assessment Malicious dependency code would run with the privileges of the account executing `pip` or the uploader. Dependin ...[truncated 651 chars]- Remediation
View remediation