lintai docs

Appearance

Rule Reference

SEC745lintai-ai-securitystablejsonwarn

package.json: unbounded dependency version

package.json uses an unbounded dependency version like * or latest

Provider
lintai-ai-security
Surface
json
Scope
per_file
Tier
stable
Severity
warn
Confidence
high
Detection
structural
Remediation
message_only

Activation Model

Preset Membership

This rule is part of the builtin activation graph through these preset memberships.

supply-chainmembership

Lifecycle

Stable Lifecycle Contract

State

stable_gated

Graduation rationale

Checks committed package.json dependency sections for unbounded or mutable selectors that undermine reproducibility.

Deterministic signal basis

JsonSignals package manifest analysis over dependency sections for exact specs equal to `*` or `latest`.

Malicious corpus
package-manifest-unbounded-dependency
Benign corpus
package-manifest-pinned-dependency-safe
structured evidence required remediation reviewed
Canonical note

Structural stable rule intended as a high-precision check with deterministic evidence.

Nearby Signals

Related Rules

SEC743package.json: dangerous lifecycle scriptpackage.json defines a dangerous install-time lifecycle scriptjsonstable
SEC744package.json: git or forge dependency sourcepackage.json installs a dependency from a git or forge shortcut sourcejsonstable
SEC753package.json: direct archive URL dependency sourcepackage.json installs a dependency from a direct archive URL sourcejsonstable
SEC301MCP config: shell trampolineMCP configuration shells out through sh -c or bash -cjsonstable
SEC302Config: insecure HTTP endpointConfiguration contains an insecure http:// endpointjsonstable
SEC303MCP config: credential env passthroughMCP configuration passes through credential environment variablesjsonstable

Why It Matters ​

Unbounded dependency selectors reduce reproducibility and make installs drift over time, which increases supply-chain review risk for shared automation and CI.

What Triggers ​

SEC745 matches dependency entries in package.json when the version spec is exactly * or latest inside dependency sections such as dependencies, devDependencies, optionalDependencies, or peerDependencies.

False Positives ​

Some throwaway demos use latest or *, but committed shared manifests should prefer explicit reviewed versions or constrained ranges so installs stay predictable.

Remediation ​

Replace * or latest with an explicit reviewed version or a constrained range that matches your update policy.