Use case
In the case of the tanstack compromise a github source was added as follows:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c"
}
however the commit hash isn't sourced to the actual tanstack/router repo contributors but rather sourced at a forked commit (details in https://snyk.io/blog/tanstack-npm-packages-compromised/)
The fix
lockfile-lint should specifically explore github related links to check if the commit/branch/tags or other references in github related URL sources actually lives in the repo or outside of it, as part of its trust mechanism, and report an error when it is not contained within the repo
Use case
In the case of the tanstack compromise a github source was added as follows:
however the commit hash isn't sourced to the actual tanstack/router repo contributors but rather sourced at a forked commit (details in https://snyk.io/blog/tanstack-npm-packages-compromised/)
The fix
lockfile-lint should specifically explore github related links to check if the commit/branch/tags or other references in github related URL sources actually lives in the repo or outside of it, as part of its trust mechanism, and report an error when it is not contained within the repo