Why It Matters

Committed lockfiles describe the exact dependency versions that a workspace installs. When an installed npm package version matches a known offline advisory, the repository is carrying a concrete supply-chain risk rather than just a loose manifest smell.

What Triggers

SEC756 scans committed package-lock.json, npm-shrinkwrap.json, and pnpm-lock.yaml files and matches installed npm package versions against the active offline advisory snapshot, which is bundled by default with lintai-dep-vulns.

False Positives

This first release is intentionally narrow. It only reports package versions that match deterministic affected-version ranges from the active offline advisory snapshot, and it does not guess from package.json ranges or use live network lookups during scan.

If a committed lockfile records an advisory-tracked package with an invalid installed version string, the advisory provider fails closed with a runtime error instead of silently skipping that package.

Remediation

Upgrade the affected package to a non-vulnerable version recorded in the relevant advisory, regenerate the lockfile, and review any transitive dependency path that keeps the vulnerable version installed.