Big update!Introducing GitHub Bot Commands. Learn more
Socket
Log inDemoInstall

GitHub dependency

Severity

High

Description

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

Suggestion

Publish the GitHub dependency to npm or a private package repository and consume it from there.


Packages with this issue

Socket[email protected]

Product

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc