Add lockfile deny-list CI guard#2
Conversation
Blocks compromised package versions from entering lockfiles: - axios@1.14.1 and axios@0.30.4 (compromised 03/30/2026) - plain-crypto-js (phantom dependency, any version) - mcp-remote@0.1.0 Runs on PRs touching package-lock.json / yarn.lock / pnpm-lock.yaml and on push to main. Rejects the PR with an actionable error if a compromised version is present. Matches the workflow already live in hank-dashboard, caretrack-dashboard, nerve-center, shcfsp-portal, and tung-dashboard. Per Geoffrey 04/20 supplemental sweep.
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 58 minutes and 4 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
What
Adds the lockfile deny-list CI guard that is already live in hank-dashboard, caretrack-dashboard, nerve-center, shcfsp-portal, and tung-dashboard.
Why
On 03/30/2026 the axios npm package was compromised. Versions
1.14.1and0.30.4shipped with a phantom dependencyplain-crypto-js@4.2.1that drops a cross-platform RAT. This CI guard blocks any PR that introduces those versions (ormcp-remote@0.1.0, another known bad version) into the lockfile.How
Runs on PRs that touch
package-lock.json,yarn.lock, orpnpm-lock.yaml, and on push to main. Fails the run with a clear error if any denied version is present. No change to application code.Per Geoffrey 04/20 supplemental sweep.