T08 · Insecure Dependencies
Warning
- Location
scripts/install.sh:5- Finding
Unpinned Third-Party Package Installation Enables Supply-Chain Compromise
- Content
View full analysis
/dev/null; then pip install dfseo elif command -v pip3 &> /dev/null; then pip3 install dfseo else echo "Error: pip not found. Install Python 3.11+ first." >&2 exit 1 fi if command -v dfseo &> /dev/null; then echo "✓ dfseo-cli installed successfully" dfseo --version ``` `SKILL.md:13-18`: ```yaml install: - id: pip kind: pip package: dfseo bins: - dfseo ``` ### Technical Analysis The installation process retrieves the package named `dfseo` from the active pip package index without specifying an audited version or cryptographic hash. It also does not verify the package publisher, source repository, or artifact provenance. Consequently, the effective code installed by the Skill can change after this repository has been reviewed. The repository does not contain the implementation of the `dfseo` CLI, so its network destinations, credential handling, and local behavior cannot be independently verified from the audited files. The installation script immediately invokes the installed executable with `dfseo --version`. A malicious or compromised package could therefore receive code execution during installation, build processing, or subsequent executable invocation. This is not direct evidence that the current `dfseo` package is malicious. The vulnerability is the absence of dependency pinning and integrity controls around a package that handles DataForSEO credentials and performs authenticated network operations. ### Attack Path 1. An attacker compromises the `dfseo` package, its publisher account, or a package index configured in the victim's pip environment. 2. The attacker publishes a modified release under the package name expected by ...[truncated 1341 chars]- Remediation
View remediation