Description

Detects Swift projects that are missing the Package.resolved lock file when dependencies are declared. Missing lock files can lead to dependency confusion attacks and inconsistent package versions, potentially introducing security vulnerabilities when dependencies are updated unexpectedly.

Detection Strategy

• Scans Swift project files for PackageDescription import statements indicating package dependencies

• Checks if a Package.resolved file exists in the same directory as the package manifest

• Reports a vulnerability if package dependencies are declared but no Package.resolved lock file is found