T08 · Insecure Dependencies
Error
- Location
assets/test-corpus/run.sh:128- Finding
Mutable npm Dependencies Are Installed and Executed Without a Lockfile
- Content
View full analysis
/dev/null 2>&1) fi echo " ⏳ render Remotion baseline" if ! (cd "$fixture_dir/remotion-src" && \ npx --no-install remotion render "$composition_id" out/baseline.mp4 >/dev/null 2>&1); then ``` The Tier 3 manifest, representative of the mutable dependency declarations, contains: ```json { "name": "tier-3-data-driven-remotion", "version": "0.0.0", "private": true, "scripts": { "render": "remotion render Stargazed out/baseline.mp4" }, "dependencies": { "@remotion/cli": "^4.0.0", "react": "^18.3.1", "react-dom": "^18.3.1", "remotion": "^4.0.0", "zod": "^3.22.0" } } ``` The documented quick path also invokes HyperFrames through `npx` without `--no-install` or an exact package version: ```bash # Render Remotion baseline (after npm install in the fixture) cd remotion-src && npx remotion render out/baseline.mp4 # Render HF translation cd ../hf-src && npx hyperframes render --output ../hf.mp4 ``` ### Technical Analysis The project does not include lockfiles for the fixture projects, while all dependencies use caret ranges. Running `npm install` can therefore resolve different direct and transitive package versions over time. Standard npm installation also permits dep ...[truncated 1916 chars]- Remediation
View remediation