T08 · Insecure Dependencies
- Location
requirements.txt:1- Finding
Unpinned Third-Party Dependencies Allow Non-Reproducible and Potentially Unsafe Package Resolution
- Content
View full analysis
Vulnerability Details
File Location:
requirements.txt:1-2; installation guidance atSKILL.md:26-30
Vulnerability Type: Unpinned third-party dependencies and expanded optional dependency set
Risk Level: MediumVulnerable code in
requirements.txt:text yfinance mootdx[all]Related installation command in
SKILL.md:bash python3 -m pip install -r requirements.txtTechnical Analysis
Neither dependency has an exact version constraint or an integrity hash. The
mootdx[all]declaration additionally installs an expanded set of optional and transitive dependencies. Package resolution therefore depends on the versions available from the configured package index at installation time, meaning that two installations of the same reviewed project may execute different third-party code.This creates a supply-chain exposure: a compromised, malicious, unexpectedly replaced, or incompatible future package release could be selected without any change to this repository. Hash verification is also absent, so the installation process does not verify artifacts against a repository-approved set of cryptographic digests.
The project does not automatically install these packages from its Python script, and no evidence shows that the currently published dependencies are malicious. The risk arises when a user follows the documented installation command and resolves externally controlled package versions that were not fixed and reviewed with the project.
Attack Path
- An attacker compromises a dependency account, release process, distribution artifact, or relevant transitive dependency and publishes a malicious version.
- A user follows the documented command:
python3 -m pip install -r requirements.txt. - Because no exact versions or hashes are specified, pip may resolve and download the attacker-controlled release.
- Malicious package code may execute during installation, import, o ...[truncated 818 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin every direct dependency to a reviewed exact version, for example:
text yfinance==<reviewed-version> mootdx==<reviewed-version> -
Replace
mootdx[all]with the base package or only the specific extras required by the implemented commands. -
Generate and commit a lock file containing resolved transitive versions.
-
Record cryptographic hashes for every approved distribution and install with:
bash python3 -m pip install --require-hashes -r requirements.txt -
Regenerate pins and hashes through a controlled dependency-update process that includes package provenance review, vulnerability scanning, and functional testing.
-
Install dependencies in an isolated, non-privileged virtual environment or container rather than as root or into the system Python environment.
-
Configure pip to use only trusted package indexes and prevent unintended fallback to unapproved public or supplemental indexes.
-