All rules MCP04
MCP04 — Supply Chain
Summary
Loose semver pins, missing lockfiles, audited vulnerabilities, or known-malicious packages.
Detection
Parses package.json, asserts a lockfile is present, runs `npm audit --json` (with shell:false, 10s timeout, no shell expansion), and matches against a curated malicious-package list shipped in the CLI.
Bad example
// BAD — caret range and no lockfile
"dependencies": { "left-pad": "^1.0.0" }Good example
// GOOD — exact pin + committed lockfile
"dependencies": { "left-pad": "1.3.0" }Fix
Pin exact versions for runtime deps, commit pnpm-lock.yaml / package-lock.json, run npm audit on every PR, and review transitive changes.