Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

lockfile-lint-api

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.5npmAmendedPublished

    lockfile-lint-api Vulnerable to Incorrect Behavior Order

    CVE-2025-4759 · GHSA-7cfr-5cjf-32p4

    Affected
    • npm lockfile-lint-api < 5.9.2
    Fixed in
    5.9.2· Vendor fix available
    Issue
    Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.

    Recommended action: Upgrade to 5.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →