T08 · Insecure Dependencies
- Location
package.json:27- Finding
Unpinned Unofficial Dependency Receives Cookidoo Credentials
- Content
View full analysis
Vulnerability Details
File Location:
package.json:27-29; related installation instructions inREADME.md:33-35andSKILL.md:28-30; credential handoff inscripts/cookidoo_cli.py:48-51
Vulnerability Type: Unpinned third-party dependency / software supply-chain risk
Risk Level: MediumComplete Code Snippets
package.json:27-29:json "dependencies": { "python": ["cookidoo-api"] }README.md:33-35andSKILL.md:28-30:bash pip install cookidoo-apiscripts/cookidoo_cli.py:48-51:python email, password = get_credentials() async with Cookidoo(email, password) as cookidoo: await cookidoo.login()Technical Analysis
The project declares and recommends installing the unofficial
cookidoo-apipackage without an exact version constraint, lockfile, or package-integrity hash. A fresh installation therefore resolves to whichever release is available from the configured Python package index at installation time.The imported package executes within the CLI process and is instantiated with the user's Cookidoo email address and plaintext password. Python package code can also execute during installation or import. Consequently, a compromised, malicious, or unexpectedly changed future release could access the credentials and execute arbitrary code with the privileges of the user running the CLI.
The audited project does not itself fetch and execute a remote payload or contain confirmed malicious code. The risk arises from its unconstrained trust in a mutable third-party supply-chain component.
Attack Path
- An attacker compromises the publisher account, distribution infrastructure, or a future release of
cookidoo-api. - The attacker publishes a malicious package version under the dependency name already recommended by the project.
- A user follows the documented
pip install cookidoo-apiinstruction. Because no version or hash is specified, ...[truncated 1122 chars]
- An attacker compromises the publisher account, distribution infrastructure, or a future release of
- Remediation
View remediation
Remediation Suggestions
- Pin
cookidoo-apito an exact, reviewed release rather than accepting the latest available version. - Maintain the Python dependency in a lockfile or requirements file with cryptographic hashes, for example by using
pip-toolsand installing withpip install --require-hashes. - Update
package.json,README.md, andSKILL.mdso all dependency declarations and installation commands refer to the same pinned version and verified hashes. - Review the package's source, publisher identity, release history, and transitive dependencies before selecting or upgrading the pinned release.
- Perform dependency upgrades through a controlled review process with automated vulnerability, malware, and provenance checks.
- Run the CLI with least privilege and, where practical, isolate it in a virtual environment or container with restricted filesystem and network access.
- Prefer token-based or otherwise revocable authentication if the upstream API supports it, rather than supplying the account password directly to a third-party library.
- Pin