T08 · Insecure Dependencies
Warning
- Location
SKILL.md:24- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
= 2024.01.01`, this does not constrain installation to a known-good release. No evidence indicates that the current `yt-dlp` package or the documented package name is malicious. The risk arises because the effective dependency can change after this skill has been reviewed. If the package distribution channel, maintainer account, or a future release were compromised, users following this instruction could install code that was never covered by this audit. Python packages may execute code during installation or when subsequently invoked. ### Attack Path 1. An attacker compromises the dependency maintainer account, package distribution process, or package index infrastructure. 2. The attacker publishes a malicious release under the legitimate `yt-dlp` package name. 3. A user follows the skill's unpinned `pip install yt-dlp` instruction. 4. pip resolves the attacker-controlled release because no exact version or integrity hash is required. 5. Malicious package code executes during installation or when the user invokes `yt-dlp`. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the account running pip or invoking the installed package. Depending on those privileges, the attacker could access user-readable files, environment variables, browser data, authentication cookies, and network resources, or modify files owned by the user. If installation is performed with administrative privileges, the impact could extend across t ...[truncated 171 chars]- Remediation
View remediation
" ``` 2. Distribute a hash-locked requirements file and require hash verification: ```text yt-dlp== --hash=sha256: ``` ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Obtain hashes directly from a trusted release artifact or package index and update them only after reviewing the new release. 4. Install the dependency in an isolated virtual environment rather than the system Python environment: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 5. Avoid running pip with root or administrator privileges. Use a trusted package index over TLS and consider disabling unexpected secondary indexes to reduce dependency-confusion exposure. 6. Add a documented dependency-update process that includes release review, integrity verification, and periodic vulnerability scanning. ]]>