Appearance
SEC450 / MD-NPM-HTTP-REGISTRY
SEC450 flags AI-native markdown when an npm, pnpm, yarn, or bun install example uses --registry http://... or --registry=http://....
Why It Matters
JavaScript package install examples that force --registry http://... disable normal TLS protection for package resolution. In AI-native markdown, users often copy these commands directly.
Trigger Shape
lintai reports this rule when AI-native markdown contains an exact package-install command such as:
npm install ... --registry http://...npm i ... --registry http://...pnpm install ... --registry http://...pnpm add ... --registry http://...yarn add ... --registry http://...bun add ... --registry http://...npm install ... --registry=http://...pnpm add ... --registry=http://...yarn add ... --registry=http://...bun add ... --registry=http://...
The finding points to the http:// source.
Clean Cases
npm install ... --registry https://...pnpm add ... --registry https://...yarn add ... --registry https://...bun add ... --registry https://...- unrelated prose that does not contain an exact install command with
--registry http://
Trigger Example
bash
npm install demo --registry http://registry.example.test/Safer Example
bash
pnpm add demo --registry https://registry.example.test/Remediation
Use a normal TLS-verified https:// package registry instead of an http:// registry.