fix: resolve every dependency from npmjs.org, not a corporate mirror - #109
Merged
Conversation
34 entries in package-lock.json pointed at Microsoft-internal Azure DevOps feeds (ms-feed-*.pkgs.visualstudio.com) instead of npmjs.org. They were written by npm install running behind a machine-level registry proxy, and most of them arrived with the security bumps in 04bc0ae, so the fix for the advisories quietly shipped the mirror too. The feed is publicly readable, which is why CI never went red. It is still wrong: a public repo should not route anyone's install through another company's infrastructure, and it splits the trust root for exactly the packages that were bumped to fix advisories. The tarballs are byte-identical, so only the URL host changes. npm ci against npmjs.org re-verifies all 310 integrity hashes unchanged. .npmrc pins the registry so the same proxy can't rewrite these URLs again the next time anyone runs npm install on a configured machine. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3cf40db0-fafb-4793-92c6-3fe2b92d70bd
This was referenced Aug 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
34 entries in
package-lock.jsonresolved to Microsoft-internal Azure DevOps feeds rather than npmjs.org:They were written by
npm installrunning behind a machine-level registry proxy. This is my own regression — look at which packages:postcss,undici,nanoid,brace-expansion,js-yaml. Those are exactly the ones bumped in #104 to clear the Dependabot advisories, so the fix for the advisories quietly shipped the mirror along with it. The rest are the@babel/browserslistchain.Why CI never caught it
The feed is
1es-public/npm-publicand answers anonymously (303), sonpm cion a GitHub runner succeeds. Green check, wrong source. That's the same shape as everything else found in this repo — a signal that looks fine because the failure mode isn't loud.It's still worth fixing:
What changed
Only the URL host. The tarballs are byte-identical, which is verified rather than assumed: a clean
rm -rf node_modules && npm ci --registry https://registry.npmjs.org/re-checks all 310 integrity hashes against npmjs.org and passes unchanged. If any tarball had differed,npm ciwould have failed on the hash..npmrcpins the registry at the repo level so the proxy can't rewrite these URLs again the next time anyone runsnpm installon a configured machine. Confirmed working —npm config get registryinside the repo now returns npmjs.org despite the global setting still pointing at the proxy.Verification
npm cifrom npmjs.org, lint, typecheck, 286 tests, and build all pass. The lockfile is stable —npm cidoes not modify it, so the diff is exactly the 34 intended URL rewrites and nothing else.