Supply chain analysis: Dependabot bump of vite and js-yaml

[dependabot]

Dependabot PR bumping vite 7.1.6→7.3.2 and js-yaml 4.1.0→4.1.1 — analyzed for supply chain compromise at maintainer request.

Findings

• Integrity hashes: SHA-512 digests in package-lock.json match npm registry exactly for both packages — tampered packages would diverge here.
• Resolution sources: All 267 packages in the lockfile resolve from registry.npmjs.org; none missing integrity hashes.
• Commit author: Official dependabot[bot] (id 49699333).
• js-yaml@4.1.1 provenance: GitHub tag 4.1.1 on nodeca/js-yaml points to a commit by the original maintainer Vitaly Puzrin (puzrin, id 319465). The release patches a prototype pollution vulnerability in YAML merge key (<<) handling — a legitimate security fix.
• vite@7.3.2: Routine release published 2026-04-06 by the vitejs team.
• Advisory DB: No CVEs found for either updated version.

Verdict

No supply chain attack. Safe to merge; js-yaml@4.1.1 in particular is a security improvement.

[gpotter2]

@copilot Does this contain a supply chain attack? make all the analysis required

[Copilot]

@copilot Does this contain a supply chain attack? make all the analysis required

No supply chain attack detected. Here is the full analysis:

---

1. Commit Author — Legitimate Dependabot
The single commit (5f94832) was authored by dependabot[bot] (GitHub account id 49699333), the official GitHub Dependabot service.

---

2. Package Integrity Hashes — Match npm Registry Exactly

Package	Lock-file integrity	npm registry integrity	Match?
vite@7.3.2	sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg==	sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg==	✅
js-yaml@4.1.1	sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==	sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==	✅

---

3. All 267 packages resolve from registry.npmjs.org — no private or suspicious registry. All packages carry integrity hashes.

---

4. Package provenance

• vite@7.3.2: Published 2026-04-06 by the vitejs team. No known CVEs.

• js-yaml@4.1.1: Published 2025-11-12. The GitHub tag 4.1.1 points to commit cc482e7 authored by Vitaly Puzrin (puzrin, id 319465) — the original long-standing maintainer. The release contains a security fix ("fix prototype pollution in merge (<<)"), not added code or backdoors. No known CVEs.

  The npm user email changed from vitaly@rcdesign.ru (4.1.0) to vitaly@rcopen.com (4.1.1). Both domains belong to the same person and this is consistent with a personal email update, not an account takeover.

---

5. GitHub Advisory Database — No vulnerabilities found in either vite@7.3.2 or js-yaml@4.1.1.

---

Conclusion: This PR is a routine, legitimate security/maintenance bump generated by Dependabot. js-yaml@4.1.1 in particular fixes a prototype pollution vulnerability in the YAML merge key (<<) handling. There is no evidence of a supply chain attack.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/nodeca/js-yaml/releases
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)
• https://api.github.com/repos/nodeca/js-yaml/tags
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)