T08 · Insecure Dependencies
Warning
- Location
scripts/install.sh:18- Finding
Unpinned Third-Party Dependencies Create Supply-Chain Risk
- Content
View full analysis
/dev/null; then echo "Warning: Required Python packages (requests, beautifulsoup4) not found." echo "You may need to install them with: pip install requests beautifulsoup4" fi ``` `README.md:76-79`: ```bash Ensure you have Python 3 and required packages installed: ```bash pip3 install requests beautifulsoup4 ``` ``` ### Technical Analysis The project instructs users to install `requests` and `beautifulsoup4` without specifying reviewed versions, package hashes, a lockfile, a trusted package index, or an isolated environment. Consequently, the effective dependency code can change independently of the audited skill. The package names shown are established packages, and the project does not intentionally reference a known malicious package. The risk arises from mutable dependency resolution: a compromised upstream release, package-index compromise, or malicious dependency update could be selected when a user follows the documented command. The installation script only prints the command rather than executing it automatically. Exploitation therefore requires a user or automation system to follow the installation guidance. ### Attack Path 1. An attacker compromises a dependency release, its maintainer account, or the package-distribution channel. 2. A new malicious or compromised version becomes the version selected by an unconstrained `pip install`. 3. A user follows the command in `README.md` or the recommendation printed by `scripts/install.sh`. 4. Pip downloads and installs the mutable dependency version. 5. Malicious package installation behavior or subsequently imported package code executes under the inst ...[truncated 558 chars]- Remediation
View remediation
\ --hash=sha256: beautifulsoup4== \ --hash=sha256: ``` 2. Install with hash verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Generate and commit a lockfile using a dependency-locking tool, including pinned transitive dependencies. 4. Specify an approved HTTPS package index rather than relying on ambient pip configuration. 5. Recommend installation inside a dedicated virtual environment instead of the user's global Python environment. 6. Regularly review and update pinned versions after security testing rather than allowing automatic selection of new releases. 7. Update both `README.md` and `install.sh` so their dependency instructions remain consistent. ]]>