T08 · Insecure Dependencies
Warning
- Location
scripts/analyze_stock.py:4- Finding
Unpinned Third-Party Dependencies Allow Unreviewed Code Execution
- Content
View full analysis
=0.2.40", # "pandas>=2.0.0", # "fear-and-greed>=0.4", # "edgartools>=2.0.0", # "feedparser>=6.0.0", # ] ``` The other executable scripts use the same open-ended dependency pattern: ```python # scripts/dividends.py # dependencies = [ # "yfinance>=0.2.40", # "pandas>=2.0.0", # ] # scripts/portfolio.py # dependencies = ["yfinance>=0.2.40"] # scripts/watchlist.py # dependencies = [ # "yfinance>=0.2.40", # ] ``` `README.md:143` and `SKILL.md:152` instruct users to install an unpinned global npm package: ```bash npm install -g @steipete/bird ``` ### Technical Analysis The PEP 723 dependency declarations specify minimum versions but no upper bounds, exact versions, hashes, or audited lockfile. When the scripts are launched through `uv run`, a future package release satisfying these constraints can be downloaded and executed even though that release was not part of the reviewed project. The Twitter integration also directs users to install the latest available version of `@steipete/bird` globally. The resulting executable is invoked while Twitter session credentials are available in its environment. This makes compromise of that package, its publisher, or its distribution channel particularly consequential. No evidence was found that the currently named dependencies are malicious. The vulnerability is that dependency resolution permits future, unreviewed code to execute automatically. ### Attack Path 1. An attacker compromises a dependency publisher account, package release process, or upstream distribution channel. 2. The attack ...[truncated 1162 chars]- Remediation
View remediation