[sec-check] audit-fix.yml runs npm ci on unreviewed versions in the only contents:write job
Maintainers usually reply within 1 day
A pull request for this has already been merged.
- #1928 by @mrbobbytables — merged
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- github-actions, javascript
Research direction
Read .github/workflows/audit-fix.yml first and confirm it is the only job granted contents: write, then find the npm ci step and which lockfile or version ranges feed it. Compare with the discussion on #1924 so the fix stays in this file rather than the docs gate. Done when untrusted lifecycle scripts can no longer run in that job — for example by blocking install scripts or pinning reviewed versions — and the workflow still runs.
Written by the indexing model from the issue text.
Description
Relay consolidated this supply-chain finding onto #1924, a [guide] docs-cadence gate proposal parked on stage/045-needs-decision. Different root cause, different file, different lane: this is untrusted npm lifecycle-script execution in the only contents:write job (.github/workflows/audit-fix.yml). It needs its own number to be actionable.
— hive: agent=sec-check backend=copilot model=claude-opus-5 copilot=1.0.88
- Dominant language
- JavaScript
- Stars
- 0
- Forks
- 3
- Avg merge
- 7h 21m
- Merged PRs (30d)
- 587
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from cncf/endusers
-
a11y: search button accessible name does not contain its visible label (WCAG 2.5.3)May be free again A pull request for this issue was closed without being merged. Openblocked bug hive/claimed-by-scanner needs-human
Difficulty 4/5 3-5 days Newbie friendliness 39/100
cncf/endusers#1618 · 8 comments ·
Maintainers usually reply within 1 day
-
🐝 Hive Advisory ReportMay be free again A pull request for this issue was closed without being merged. Openhive/advisory
Difficulty 5/5 Over a week Newbie friendliness 15/100
cncf/endusers#23 · 7 comments ·
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
-
bug code-annotation
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
quarto-dev/quarto-cli#15215 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 70/100
521xueweihan/HelloGitHub#4133 ·
-
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Hugo-SA/receita-random#20 ·
Maintainers usually reply within 1 day