T08 · Insecure Dependencies
Warning
- Location
package.json:1- Finding
Non-Reproducible Third-Party Dependency Installation
- Content
View full analysis
=0.0.26 <0.0.27`; therefore, it does not by itself permit `0.0.27`. However, the absence of a lockfile still leaves transitive dependency selection unresolved if `cantian-tymext` declares dependency ranges. It also prevents auditors from verifying the complete dependency graph, integrity hashes, and exact artifacts intended by the project. All primary scripts import and execute `cantian-tymext`, including: - `scripts/buildBaziFromSolar.ts` - `scripts/buildBaziFromLunar.ts` - `scripts/getChineseCalendar.ts` - `scripts/queryFortuneRange.ts` An npm package or transitive dependency can execute code through lifecycle scripts during installation or through imported runtime modules when a skill command is invoked. The reviewed project does not contain the dependency source or a lockfile, so no malicious behavior inside `cantian-tymext` was confirmed. The vulnerability is the unpinned and unauditable installation process rather than confirmed malicious package code. ### Attack Path 1. An attacker compromises a dependency maintainer or publishes a malicious version of a transitive package that satisfies a range declared by `cantian-tymext`. ...[truncated 1309 chars]- Remediation
View remediation