Insecure Flutter package dependency declared in pubspec.yaml
ID |
dart.config.pubspec_insecure_dependency |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Config |
Language |
Dart |
Description
A pubspec.yaml entry uses http:// for a hosted dependency URL, pulls a package directly from a git: source (bypassing pub.dev integrity checks and malware scanning), or includes a dependency_overrides: block (which defeats version pinning and Software-Bill-of-Materials assumptions for production).
Rationale
pub.dev is the canonical Dart / Flutter package registry. Packages fetched from pub.dev are signed, hash-verified, and pass through the Flutter team’s malware-scanning pipeline. Going outside that pipeline introduces supply-chain risk:
-
http://hosted URL: dependencies are fetched in cleartext; an attacker on the path serves a malicious tarball. -
git:source: pulls whatever HEAD (or the pinned ref) of the remote repo currently contains. The repo owner can rewrite history, retag, or have their account compromised. No malware scanning happens. -
dependency_overrides:is intended for local development (testing a fork or an unreleased version), not production. It silently replaces a transitive dependency for the entire app — the version printed inpubspec.lockis not what actually ships, breaking SBOM assumptions and CVE-tracking pipelines.
This rule mirrors the Dart team’s first-party
secure_pubspec_urls lint and extends it with the
dependency_overrides and git: checks.
Remediation
Use https:// for any hosted mirror, pull production
dependencies from pub.dev via ^x.y.z constraints, and remove
dependency_overrides: before publishing or shipping a release
build.
# Vulnerable
dependencies:
pkg:
hosted:
url: http://my-mirror.example.com
version: ^1.0.0
forked:
git: https://github.com/someone/forked_pkg.git
dependency_overrides:
transitive_dep: ^2.0.0
# Fixed
dependencies:
pkg:
hosted:
url: https://my-mirror.example.com
version: ^1.0.0
forked: ^1.0.0 # publish the fork to pub.dev under your name
# remove dependency_overrides before shippingReferences
-
OWASP Top 10 2025 - A03 : Software Supply Chain Failures.
-
OWASP Top 10 2025 - A08 : Software or Data Integrity Failures.
-
CWE-494 — Download of Code Without Integrity Check
-
Talsec — OWASP Mobile Top 10 for Flutter M2 — Inadequate supply-chain security in Flutter
-
Dart linter — secure_pubspec_urls — The first-party lint that this rule extends
-
Dart / pub.dev security advisories — Canonical CVE feed for the pub.dev ecosystem