This open source tool tracks the AI security advice it gave you that's no longer worth anything

When you ask an AI assistant to fix a vulnerability in one of your dependencies, it almost always suggests the same thing: adding what's called an "override", a configuration line that forces your project to use a healthy version of a software component.

The advice seems sound at the time. But here's the thing - nobody ever tells you to go back and check, six months later, whether that line still serves any purpose.

That's precisely the gap that CVE Lite CLI plugs - a free, open source scanner developed by Sonu Kapoor and endorsed by OWASP, the foundation that sets the standard for application security. The tool runs locally, requires no account or cloud connection, and not a single line of your code ever leaves your machine.

The problem it targets is straightforward. A transitive dependency is a component that another component - one you actually installed - depends on: you never chose it yourself, but it ends up bundled into your project anyway. To neutralize a vulnerability lurking inside it, you force a patched version through an override. The trouble is that this patch quietly ages on its own, behind your back.

Kapoor therefore added a function that audits these configurations and hunts down three scenarios: the override points to a package that simply no longer exists, it applies to the wrong package manager, or it uses a wildcard pattern (a kind of catch-all meant to match multiple paths at once) that in practice matches nothing. In all these cases you think you're protected when the protection has actually been gone for a while.

To prove the point, he ran four widely used JavaScript projects through the scanner, and the results speak for themselves. Cal.com had 90 of them, 11 of which were completely ineffective; Jest was dragging along a configuration that pointed at nothing; NoCoDB was stacking up useless wildcards; only .js came through without a single issue.

Between the node-ipc incident of 2022 - where a developer deliberately sabotaged his own package out of activism - and the recent wave of Shai-Hulud attacks, a self-replicating worm that steals developers' npm access tokens to contaminate all their other packages in the process, the JavaScript ecosystem is taking a beating. And a dead override is a door you thought was locked.

What's amusing is that the tool designed to catch AI approximations is itself deliberately AI-free. It quietly queries a known vulnerability database and spits out ready-to-paste commands, without guessing anything.

Either way, this is a neat little tool that double-checks after the AI, and honestly, that's reassuring.

Source : The Register

Then join my community on Patreon for exclusive articles, advanced tutorials and lots of other surprises I keep for my supporters. It's thanks to you that I can keep sharing my passion after 20 years!