T08 · Insecure Dependencies
Error
- Location
package-lock.json:119- Finding
Insecure Dependency Sources and Known-Vulnerable XLSX Parser
- Content
View full analysis
=0.8" } } ``` ```json "node_modules/xlsx": { "version": "0.18.5", "resolved": "http://mirrors.tencentyun.com/npm/xlsx/-/xlsx-0.18.5.tgz", "integrity": "sha512-dmg3LCjBPHZnQp5/F/+nnTa+miPJxUXB6vtk42YjBBKayDNagxGEeIdWApkYPOf3Z3pm3k62Knjzp7lMeTEtFQ==", "license": "Apache-2.0", "dependencies": { "adler-32": "~1.3.0", "cfb": "~1.2.1", "codepage": "~1.15.0", "crc-32": "~1.2.1", "ssf": "~0.11.2", "wmf": "~1.0.1", "word": "~0.3.0" }, "bin": { "xlsx": "bin/xlsx.njs" }, "engines": { "node": ">=0.8" } } ``` The project explicitly acknowledges the dependency risk: ```yaml security: note: | - executeScript allows custom JavaScript execution - use with trusted code only - xlsx package has known vulnerability (GHSA-4r6h-8v6p-xvw6) - only process trusted files - See SECURITY_AUDIT.md for details ``` ### Technical Analysis All dependencies recorded in `package-lock.json` use plaintext HTTP URLs under `mirrors.tencentyun.com`. HTTP provides no transport authentication or confidentiality, allowing a network-positioned attacker to intercept, block, redirect, or alter dependency-download traffic. The included SHA-512 integrity fields normally prevent silently modified archives from being accepted when the lockfile itself remains trusted. They materially ...[truncated 2400 chars]- Remediation
View remediation