Security vulnerabilities and automated fixes for package security issues
2 posts found
The apple-mail-mcp repository was vulnerable to supply chain timing attacks because its pnpm workspace configuration only enforced a 1-day (1440 minute) minimum release age for newly published packages. This allowed a 5-day-old transitive dependency (ip-address@10.5.0) to be installed despite Dependabot's 7-day cooldown, creating a window where malicious or unstable packages could enter the dependency tree. The fix raises minimumReleaseAge to 10080 minutes (7 days) to ensure all packages—includi
A missing `trustPolicy` configuration in `pnpm-workspace.yaml` left a Node.js library vulnerable to supply chain attacks where malicious package updates could downgrade security settings. Combined with insufficient input validation in the todo application component, this created a medium-severity attack surface. The fix adds `trustPolicy: no-downgrade`, `blockExoticSubdeps: true`, and `minimumReleaseAge: 10080` to harden the package manager configuration.