T08 · Insecure Dependencies
Warning
- Location
scripts/ziwei_chart.py:228- Finding
Unpinned and Unlocked Third-Party Dependencies
- Content
View full analysis
Any: try: from iztro_py import astro except ModuleNotFoundError as exc: raise RuntimeError("未安装 iztro-py，请先安装：pip install iztro-py") from exc return astro ``` ```python def render_jpg_cairosvg(svg: str, quality: int = 92) -> bytes: try: import cairosvg except ModuleNotFoundError as exc: raise RuntimeError("生成 JPG 需要 cairosvg，请先安装：pip install cairosvg") from exc try: from PIL import Image except ModuleNotFoundError as exc: raise RuntimeError("生成 JPG 需要 pillow，请先安装：pip install pillow") from exc ``` ```javascript import { astro } from 'iztro'; ``` ### Technical Analysis The runtime error messages recommend installing `iztro-py`, `cairosvg`, and `pillow` without exact version constraints or package hashes. The JavaScript engine imports `iztro`, but the audited project contains no `package.json`, package lockfile, or integrity metadata defining the reviewed dependency version. The payload includes broad version requirements such as `iztro-py >=0.3.4` and `iztro >=2.5.7`, but these are informational values rather than enforced, reproducible dependency controls. An installation can therefore resolve to a newer and materially different package or transitive dependency than the version reviewed by the project author. The project does not automatically run a package manager and contains no evidence that the named dependencies are currently malicious. Exploitation is conditional on a user or deployment process following the unrestricted installation guidance or otherwise installing dependencies without a trusted lockfile. ### A ...[truncated 1622 chars]- Remediation
View remediation