[SEC-MED] Unpinned npm dependencies — supply chain attack risk (31 packages)

[cmnisal]

🟡 Medium Security Finding

Severity: Medium | Control: AS-02 / VTPM-02 | CISO Audit June 2026

Finding

31 dependencies in package.json use ^ or ~ version prefixes, meaning npm install can silently pull a newer (potentially compromised) version on every fresh install. This is a supply chain attack vector — a malicious publish to any of these packages (typosquatting, account takeover, dependency confusion) would be automatically pulled into builds.

Example unpinned packages: @tanstack/react-query, @telegram-apps/sdk, mongoose, axios

Actions Required

• Pin all dependencies and devDependencies to exact versions (remove ^ and ~ prefixes)
• Run npm install after pinning to regenerate package-lock.json with exact resolved versions
• Commit both package.json and package-lock.json
• Consider adding npm config set save-exact true as org default to enforce pinning going forward
• Add a CI lint step (e.g. lockfile-lint or a custom script) to fail builds if unpinned versions are introduced

Why This Matters

Supply chain attacks via npm are increasingly common (e.g. event-stream 2018, ua-parser-js 2021, node-ipc 2022). Pinning ensures only audited, reviewed versions are used — any update becomes an explicit, reviewable change.