[anupamme]

Summary

Fix high severity security issue in package.json.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	package.json:15
Assessment	Likely exploitable

Description: The architect-build dependency is referenced via a direct GitHub tarball URL without integrity verification. The tarball is fetched during npm install without cryptographic hash validation, allowing potential substitution of malicious code if the repository is compromised or via man-in-the-middle attack.

Evidence

Exploitation scenario: Attacker compromises the c9/architect-build repository or performs man-in-the-middle on HTTPS traffic during npm install to serve a malicious tarball.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• package.json

Behavior Preservation

This change touches only dependency manifest (package.json); no source file in the repository is modified.

Security Invariant

Property: The security boundary is maintained under adversarial input

Regression test

const { execSync } = require('child_process');
const fs = require('fs');
const path = require('path');

describe("security boundary is maintained under adversarial input", () => {
  const payloads = [
    "https://github.com/c9/architect-build/tarball/43a6fdeffe", // exact exploit: unverified tarball URL
    "https://evil.com/malicious-package.tar.gz", // boundary: non-github untrusted host
    "architect-build@1.0.0" // valid: semver with registry integrity
  ];

  payloads.forEach((payload) => {
    it(`rejects adversarial input: ${payload}`, () => {
      const pkgPath = path.join(process.cwd(), 'package.json');
      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
      
      // Security invariant: all dependency URLs must have integrity verification
      const deps = { ...pkg.dependencies, ...pkg.devDependencies };
      
      for (const [name, spec] of Object.entries(deps)) {
        if (spec.startsWith('http://') || spec.startsWith('https://')) {
          // Must have integrity hash or be from trusted registry with lockfile
          const hasLockfile = fs.existsSync(path.join(process.cwd(), 'package-lock.json'));
          const lock = hasLockfile ? JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package-lock.json'), 'utf8')) : {};
          const locked = lock.packages?.[`node_modules/${name}`] || lock.dependencies?.[name];
          
          if (!locked?.integrity && !spec.includes('#') && !spec.match(/[a-f0-9]{40}/)) {
            throw new Error(`Unverified remote dependency: ${name}@${spec} lacks integrity validation`);
          }
        }
      }
    });
  });
});

This test guards against regressions — it's useful independent of the code change above.

---

Automated security fix by OrbisAI Security

Open kitchen-sink @ 647fa056cc05fc2d161233ac89739b5bb7a86e40

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.93%. Comparing base (e369b00) to head (647fa05).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #6009      +/-   ##
==========================================
- Coverage   93.96%   93.93%   -0.03%     
==========================================
  Files         647      647              
  Lines      140337   140337              
  Branches    14740    14707      -33     
==========================================
- Hits       131861   131823      -38     
- Misses       8476     8514      +38     

Flag	Coverage Δ
unittests	93.93% <ø> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.