MediumSupply chainBLWK-DEV-008

pip skips certificate checks for a package index (‹path›)

What this means

‹path› lists ‹detail› as a trusted-host, which tells pip to accept any certificate — or none — from it. A spoofed or intercepted index can then serve packages that run code when installed.

How to fix it

Remove the trusted-host line and give pip the index's CA instead: pip config set global.cert /path/to/ca.pem

Check it yourself

Run a scan and look for BLWK-DEV-008 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads dev_tool_config and reports this check when:

kind == "pip" and trusted_host == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1195.001
• MITRE ATT&CK T1557

Related checks

• Git skips TLS certificate checks (‹path›) · BLWK-DEV-001
• Git trusts repositories owned by anyone (‹path›) · BLWK-DEV-002
• Git allows the ext:: transport, which runs commands from a URL (‹path›) · BLWK-DEV-003
• SSH doesn't check server identities (‹path›) · BLWK-DEV-004
• SSH forwards your agent to every server (‹path›) · BLWK-DEV-005
• npm/yarn installs packages without checking TLS certificates (‹path›) · BLWK-DEV-006