T08 · Insecure Dependencies
Warning
- Location
- README.md:59
- Finding
- Unpinned Third-Party Dependencies## Vulnerability Details **File Location**: `README.md:59-63`; equivalent instructions at `README_zh-CN.md:61-65` **Vulnerability Type**: Supply-chain risk from unconstrained dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip install arxiv requests ``` ### Technical Analysis The documented installation command retrieves the latest available versions of the `arxiv` and `requests` packages without version constraints or package hashes. Consequently, the source code that users install may differ from the code reviewed and tested by the project maintainers. If a dependency release, maintainer account, or package distribution channel is compromised, following these instructions could install attacker-controlled package code. Python packages may execute code during installation, and imported dependency modules execute within the context of `arxiv_tool.py`. This finding does not establish that either named dependency is currently malicious. The risk arises from the absence of version pinning and integrity verification. ### Attack Path 1. An attacker compromises a dependency's publishing account, release pipeline, or distribution artifact. 2. The attacker publishes a malicious release under the legitimate package name. 3. A user follows the project documentation and runs `pip install arxiv requests`. 4. Package resolution selects the affected latest release because no reviewed version is pinned. 5. Malicious code executes during installation or when `arxiv_tool.py` imports the package. ### Impact Assessment Successfully exploited dependency compromise could execute arbitrary code with the privileges of the user running `pip` or the tool. This may permit access to that user's readable files, modification of writable files, outbound network communication, credential theft from the process environment, or further compromise within the same privilege boundary. The project itself does not request ele ...[truncated 95 chars]
- Remediation
- ## Remediation Suggestions 1. Add a reviewed dependency file with exact versions, for example: ```text arxiv==<reviewed-version> requests==<reviewed-version> ``` 2. Generate and verify cryptographic hashes for all direct and transitive dependencies. 3. Install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use a lock-file workflow and review dependency changes before updating locked versions. 5. Document the expected package index explicitly and avoid untrusted extra indexes. 6. Add automated dependency vulnerability and provenance checks to the release process. 7. Update both English and Chinese installation documentation to use the secured installation procedure.