Software & Data Integrity Failures

Supply-chain risk: dependency confusion, slopsquatting (typosquats of popular AI / ML packages), lifecycle-script abuse in transitive dependencies, and unpinned versions in ecosystems without lockfiles. A single bad dependency runs with your application's full rights.

What Vulkro detects

Every direct and transitive dependency is matched against the local CVE bundle (OSV, NVD, KEV, EPSS), and the package_risk and slopsquat_known heuristics run over the dependency graph.

Non-compliant code

{
  "dependencies": {
    "left-pad-utility": "latest",
    "langchain-helpers": "^0.0.1"
  }
}

Compliant code

{
  "dependencies": {
    "left-pad": "1.3.0",
    "langchain": "0.0.214"
  }
}

How to fix

• Pin exact versions and commit the lockfile (package-lock.json).
• Check new package names carefully against the real project.
• Run vulkro match-cve --sbom <file> on every release, and review dependency updates before merging.

References

• CWE-1357
• CWE-829
• OWASP A08:2021

See also: Confidence model.

---

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.