No wildcard or excessively loose version ranges
Why it matters
Wildcard and unbounded version specifiers like *, latest, and >=1.0.0 mean that every npm install across your team and CI pipeline can resolve to a different package version — potentially including versions published hours ago by a compromised maintainer. SLSA L2 requires that the build be reproducible from a pinned artifact; "package": "latest" makes that impossible. CWE-1357 covers reliance on components that cannot be verified to a fixed state. SSDF PS.1 (Protect All Code from Unauthorized Access and Tampering) implicitly requires that the software composition be deterministic. AI tools in particular have a habit of generating "latest" as a version specifier — it seems convenient but it converts every npm install into a potential silent update from the registry.
Severity rationale
Medium because wildcard versions allow any future npm publish — including a malicious one from a compromised maintainer — to silently become your production code on next install.
Remediation
Replace all wildcard specifiers with pinned caret ranges. To find the currently-installed version for any dependency:
npm list package-name
Then update package.json:
// Before (dangerous):
"some-package": "*",
"another-package": "latest"
// After (safe):
"some-package": "^2.3.1",
"another-package": "^4.0.0"
Commit the resulting lock file change alongside this fix to ensure the pins are fully recorded.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Dependency & Supply Chain Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-1357 — Reliance on Insufficiently Trustworthy Component
- owasp:2021 · A08 — Software and Data Integrity Failures
- slsa:1.0 · L2 — Hosted build platform with signed provenance
- ssdf:800-218 · PS.1 — Protect All Forms of Code from Unauthorized Access and Tampering
- soc2:2017 · CC6.8 — Prevention and detection of unauthorized or malicious software
Taxons
History
- 2026-04-18·v1.0.0·Initial import from dependency-supply-chain·automated
- 2026-04-20·v1.1.0·Add Phase 6.0 detect-rg snippet for package.json wildcard-version detection·by cakleinman
- 2026-07-06·v1.1.1·Add SOC 2 TSC mapping (CC6.8) from the verified compliance crosswalk register (docs/compliance/).·by soc2-mapping-enrichment-ship-2