T08 · Insecure Dependencies
Warning
- Location
- package-lock.json:18
- Finding
- Dependency Lockfile Uses a Non-Official Package Registry## Vulnerability Details **File Location**: `package-lock.json:18-21` **Vulnerability Type**: Third-party dependency supply-chain risk **Risk Level**: Medium ### Vulnerable Code ```json "node_modules/ws": { "version": "8.19.0", "resolved": "https://registry.npmmirror.com/ws/-/ws-8.19.0.tgz", "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==", "license": "MIT", "engines": { "node": ">=10.0.0" }, "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "peerDependenciesMeta": { "bufferutil": { "optional": true }, "utf-8-validate": { "optional": true } } } ``` ### Technical Analysis The lockfile directs npm to retrieve the runtime `ws` package from `registry.npmmirror.com`, a third-party mirror rather than the official npm registry. This introduces an additional supply-chain trust boundary for package availability and provenance. The recorded SHA-512 integrity value provides meaningful protection against package content differing from the artifact represented by the current lockfile. It does not, however, remove the risks of a maliciously modified lockfile, compromised lockfile-generation environment, mirror availability failure, or reliance on an organization that has not been explicitly approved by the consumer. No evidence was found that the currently locked `ws` package is malicious. The issue is the avoidable use of an external dependency distribution source. ### Attack Path 1. A user follows the installation instructions and runs `npm install` or `npm ci`. 2. npm processes `package-lock.json` and requests the `ws` archive from `https://registry.npmmirror.com/`. 3. An attacker would need to compromise the mirror, the dependency publication or lockfile-generation process, or modify the lockfile and its integrity value. 4. A substituted dependency could subsequently be loaded by the following code at `scripts/websoc ...[truncated 1068 chars]
- Remediation
- ## Remediation Suggestions 1. Configure npm to use the official registry: ```bash npm config set registry https://registry.npmjs.org/ ``` 2. Remove and regenerate the lockfile in a trusted environment: ```bash rm -rf node_modules package-lock.json npm install ``` 3. Verify that the regenerated `resolved` entry points to `https://registry.npmjs.org/` and retains a valid integrity hash. 4. Commit the reviewed lockfile and use `npm ci` in CI/CD to enforce reproducible installation. 5. Pin or deliberately manage dependency upgrades rather than accepting unreviewed changes. 6. Add dependency vulnerability and provenance checks to CI, such as `npm audit`, lockfile policy validation, and software composition analysis. 7. Run dependency installation and application workloads with least privilege and avoid exposing unnecessary secrets to installation scripts or runtime processes. 8. If the mirror is intentionally required, document its approval, ownership, synchronization policy, integrity controls, and incident-response process.