Supply chain control missing
MediumAV-DEP-001Supply chainCore pack
What it finds
`curl | bash/sh`, unpinned `npm install`/`pip install`, `unpkg`, `cdn.jsdelivr`, or a `"latest"` version tag.
Why it matters
A compromised upstream dependency or remote script can silently alter agent behavior or steal secrets.
How to fix it
Pin dependency versions, use lockfiles, verify integrity hashes, avoid curl-to-shell installs.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- SUPPLY_CHAIN_RISK
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- package.json, requirements.txt, install scripts, or source referencing them
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.