MAL-DEPINT Lockfile and Manifest Integrity
A tampered lockfile is one of the quietest ways to plant a malicious dependency. npm ci and its yarn and pnpm equivalents trust the lockfile as the source of truth for exactly which bytes to fetch, so a single edited resolved URL or a stripped integrity hash can redirect an install to an attacker-controlled tarball on any developer or CI machine, before a line of application code runs.
What Vulkro detects
Three shapes, all Medium severity, fully offline and deterministic.
MAL-DEPINT-001 fires on a resolved tarball URL whose host is a raw IPv4 address, or whose scheme is http:// rather than https://. To keep false positives near zero the rule deliberately does not flag an arbitrary non-registry HTTPS host, because private registries such as Artifactory, Verdaccio, GitHub Packages, or a corporate mirror are legitimate and common.
MAL-DEPINT-002 fires on a registry tarball entry (a resolved ending in .tgz or .tar.gz) that is missing its integrity field while other entries in the same lockfile carry one. A lone entry with the hash stripped is the signature of a hand-edited lockfile.
MAL-DEPINT-003 fires on a package.json dependency whose specifier is a direct git+ / git:// repository, a raw http(s):// tarball, or a file: path. Each bypasses the registry, so there is no version resolution, no integrity hash, and no registry provenance. Registry semver specifiers, workspace:, npm: aliases, and catalog: are not flagged.
What this does not claim: none of these prove the dependency is malicious. The rule surfaces registry-bypass and integrity-loss shapes for a human to read before the repository is installed, and never certifies a lockfile clean.
Remediation. Regenerate the lockfile from the manifest against your real registry and diff it, so any hand-edit shows up. Require HTTPS named-host resolved URLs and an integrity hash on every registry tarball, and replace git or URL specifiers with published, versioned packages.
See also
- Confidence model - what
High,Medium, andLowmean for findings in this category. - Safety - what Vulkro does and does not access on your machine.
References
This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.