T08 · Insecure Dependencies
Warning
- Location
package-lock.json:382- Finding
Nodemailer Dependency Retrieved from a Non-Official Package Registry
- Content
View full analysis
=6.0.0" } } ``` ### Technical Analysis The setup process automatically invokes `npm install --production`. The lockfile instructs npm to retrieve the primary Nodemailer package from `registry.npmmirror.com`, while the other dependencies are predominantly retrieved from the official npm registry. Nodemailer is a security-sensitive dependency because it receives SMTP credentials, message contents, recipient addresses, and local attachment paths. Using an additional package-distribution operator expands the supply-chain trust boundary beyond the official npm registry. The pinned SHA-512 integrity value materially limits exploitation: control of the mirror alone is not sufficient to replace the package transparently because npm should reject content that does not match the lockfile hash. Successful package substitution would therefore also require modification of the lockfile integrity value, compromise or bypass of npm integrity verification, or delivery of a package already matching the trusted digest. The non-official source nevertheless creates an avoidable dependency-delivery and availability risk. ### Attack Path 1. A user runs `bash setup.sh`. 2. If `node_modules` is absent, the ...[truncated 1215 chars]- Remediation
View remediation