Description

Detects when an NPM/JavaScript project declares dependencies without having corresponding lock files (package-lock.json, yarn.lock, etc.). Missing lock files can lead to supply chain attacks since dependency versions aren't locked, allowing potential malicious package upgrades.

Detection Strategy

• Checks if package.json file contains dependencies or devDependencies

• Verifies existence of any lock file: package-lock.json, yarn.lock, pnpm-lock.yaml, or ng-package.json

• Reports a vulnerability if dependencies are declared but no lock file is found in the project or package directory

• Checks both root directory and package-specific directories for lock files