Dependency Time Bomb
What it is
Dependencies are present without enough proof of lockfile hygiene, audit status, or update discipline.
This usually appears when a prototype grows around packages that were installed quickly but never rechecked against a fresh advisory or campaign feed.
How to fix it
Commit a lockfile, run local dependency audits, pin risky packages, and document remediation status.
- 1Commit the lockfile used for the build.
- 2Run dependency audits against current public feeds.
- 3Pin or replace risky packages and document remediation status.
How VibeAudit checks for this
VibeAudit checks this with SCA_PUBLIC_FEEDS and SCA_MALICIOUS_CAMPAIGNS only when lockfile or dependency inventory evidence and feed snapshots are supplied. The free tier may show the surface name only, without private evidence or remediation details. Metadata-only surface maps do not create missing-control findings. Unsupported private repositories, authenticated behavior, destructive workflows, account configuration, and business logic remain unverified unless the scan includes matching local, imported, or authorized runtime evidence.
Related failure modes
Check your public launch surface and keep unsupported scope visible.
Run Quick Scan