T08 · Insecure Dependencies
Warning
- Location
requirements.txt:4- Finding
Unpinned Third-Party Dependencies Allow Unreviewed Package Updates
- Content
View full analysis
=3.0.0 pillow pycryptodome qrcode requests tzlocal ``` Related installation instruction: ```text pip install mijiaAPI ``` ### Technical Analysis The dependency specification permits installation of package versions that were not reviewed with this Skill. In particular, `mijiaAPI>=3.0.0` accepts any future release, while the other dependencies have no version constraints. None of the packages are protected by cryptographic hashes. Consequently, the code installed and imported by the Skill can change without any modification to the audited project. This creates a supply-chain risk if an upstream release is compromised, an unsafe future release is published, or package resolution is redirected to an untrusted index. The issue is especially relevant because `mijiaAPI` receives access to authenticated smart-home functions and associated local authentication material. The documentation states that version `3.0.5` is expected, but `requirements.txt` does not enforce that version. ### Attack Path 1. An attacker compromises an allowed dependency release, its publisher account, or a package index used by the victim. 2. The attacker publishes a malicious version satisfying the unconstrained requirement. 3. A user follows the documented `pip install mijiaAPI` or `pip install -r requirements.txt` instruction. 4. Package resolution selects the malicious or otherwise unreviewed release. 5. Malicious installation hooks or imported package code execute with the privileges of the user running pip or the Skill. 6. The dependency can access local files available to that user, including Mijia authentication data, and can issue device-control or network operations. ### Impact Assessment Successful exploitat ...[truncated 655 chars]- Remediation
View remediation