T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unverified Third-Party Dependency Installation and Execution## Vulnerability Details **File Location**: `requirements.txt:1-3`, `README.md:4-7` **Vulnerability Type**: Third-party software supply-chain risk **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1-3`: ```text libtv==0.3.2 Pillow==10.3.0 tqdm==4.66.2 ``` `README.md:4-7`: ```bash # 1️⃣ Enter the folder cd libtv-qunqin # 2️⃣ Install dependencies pip install -r requirements.txt ``` ### Technical Analysis The documented installation procedure directs users to install third-party Python packages through `pip`. Although exact package versions are specified, the dependency artifacts are not protected with cryptographic hashes, and the project does not identify a trusted package index, verified source repository, or other provenance information for the specialized `libtv` package. Version pinning prevents ordinary version drift, but it does not verify that the downloaded artifact is authentic or that the named package corresponds to the intended implementation. Python packages may execute code during installation, import, or normal runtime. The entry point imports `WebtoonCreator` from `libtv` and delegates the principal processing operation to it, giving that dependency access to the complete story text, rendering parameters, output path, filesystem permissions, network access, and other privileges of the invoking user. The repository does not itself prove that `libtv==0.3.2` is malicious. The finding concerns the absence of dependency provenance and artifact-integrity controls around executable third-party code. ### Attack Path 1. An attacker compromises the package distribution account, upstream release process, package index, or dependency delivery channel associated with `libtv`. 2. The attacker causes a malicious or substituted artifact to be served for the expected dependency. 3. A user follows the documented command `pip install -r requirements.txt`. 4. The malicious package executes co ...[truncated 1116 chars]
- Remediation
- ## Remediation Suggestions 1. Verify that `libtv==0.3.2` comes from the intended publisher and document its authoritative source repository and package-index identity. 2. Generate a fully resolved lock file containing SHA-256 hashes for every permitted distribution artifact, and install with hash verification, such as `pip install --require-hashes`. 3. Configure installations to use an explicitly trusted package index rather than relying on ambient or user-controlled `pip` configuration. 4. Audit or vendor the exact `libtv` source used by the project, including build metadata and installation hooks. 5. Build dependencies in a controlled environment and retain provenance or software bill of materials records for deployed artifacts. 6. Run installation and execution under a dedicated, least-privileged account or isolated container with restricted filesystem and network access. 7. Avoid exposing unrelated credentials or sensitive environment variables to the rendering process. 8. Add automated dependency vulnerability, provenance, and integrity checks to the release workflow.