T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned Third-Party Dependency Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `requirements.txt:1` **Related Location**: `holiday.py:11-15` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1`: ```text chinese-calendar ``` Related installation guidance in `holiday.py:11-15`: ```python try: import chinese_calendar except ImportError: print("Please install chinese-calendar: pip install chinese-calendar") sys.exit(1) ``` The quoted English message is a translation of the original installation prompt; its command is unchanged. ### Technical Analysis The project declares `chinese-calendar` without an exact version or integrity hash. The fallback message also recommends an unconstrained `pip install chinese-calendar` command. Consequently, installations are not reproducible and may retrieve any release selected by the configured package index. This does not demonstrate that the current upstream package is malicious. However, it creates a supply-chain exposure if a future release is compromised, the package owner or distribution account is compromised, or the installer is configured to use an untrusted package index. Python packages may execute code during installation, and imported modules execute top-level code at runtime. The application imports this dependency whenever `holiday.py` is loaded, so a malicious resolved package could execute before the calendar functionality is used. ### Attack Path 1. An attacker compromises the package's distribution channel or causes the victim's package installer to resolve the dependency through an attacker-controlled or untrusted index. 2. The attacker publishes a malicious release under the dependency name. 3. A user runs `pip install -r requirements.txt` or follows the installation command printed by `holiday.py`. 4. Because no version or hash is enforced, the installer accepts the attacker-controlled distribution. 5. Malicious code executes during installation or when `hol ...[truncated 664 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed release: ```text chinese-calendar==<reviewed-version> ``` 2. Generate and commit cryptographic hashes for all resolved distributions, then install with hash verification: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Use a lock-generation workflow such as `pip-tools` so direct and transitive dependencies are fixed and reviewed. 4. Install only from an explicitly approved HTTPS package index; disable unintended supplemental indexes where practical. 5. Add automated dependency vulnerability and provenance checks to CI. 6. Test dependency updates in an isolated environment before changing the reviewed pin and hashes. 7. Run installation and the Skill under a least-privileged account or isolated environment to reduce the impact of a compromised dependency.