Security / Public reference

Dependency range is floating

A dependencies, devDependencies, or optionalDependencies value that is exactly * or latest.

What you need to supply

A package.json with a top-level name plus dependencies, devDependencies, or scripts.

If it reports a finding

Medium severity. The suggested next step is to pin the dependency to a reviewed version.

What this does not prove

^1.2.3, ~1.2.3, and a pinned version are not this finding.

Range that this check is written to notice

{
  "name": "demo",
  "dependencies": {
    "left-pad": "*"
  }
}

All review checks. Reading this page does not submit your infrastructure.