Tarball'd project @serverlessinc/framework-alpha continues to install unpinned transitive dependencies #13453
Description
Issue description
Despite the recent 4.33.1 release of the framework having a fix for #13450, it looks to me like the tarball package installed at runtime by the Framework's Go code, specifically https://install.serverless.com/archives/serverless-4.33.1.tgz, still does not use a lockfile when it gets installed. Its direct dependencies are pinned, but transitive dependencies will get installed according to upstream semver, which means that those transitive dependencies cannot be vetted by the Serverless team.
One notable example of this is Axios, which will be installed as a subdependency of the AWS SDK.
Here's the 4.33.1 version's package.json file:
{
"name": "@serverlessinc/framework-alpha",
"version": "4.33.1",
"description": "",
"main": "index.js",
"type": "module",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "",
"bin": {
"serverless": "./dist/sf-core.js",
"sls": "./dist/sf-core.js"
},
"dependencies": {
"@aws-sdk/client-cloudfront-keyvaluestore": "3.1015.0",
"@aws-sdk/signature-v4-crt": "3.1015.0",
"@aws-sdk/signature-v4a": "3.1009.0",
"ajv": "8.18.0",
"ajv-formats": "3.0.1",
"esbuild": "0.27.4"
}
}If a freshly compromised version of axios was published right now as a minor version of their v1, then it would get installed on a machine running Serverless (that happened to be due for an update) because of the transitive dependency on aws-crt, which currently specifies axios at semver ^1.12.2. When running npm install --package-lock-only on that package.json file, the resulting lockfile shows, in part:
"node_modules/aws-crt": {
"version": "1.30.0",
"resolved": "https://registry.npmjs.org/aws-crt/-/aws-crt-1.30.0.tgz",
"integrity": "sha512-PSbNf2HdLT5orB91SaAR9cARBRTaYznPJIVWDeNlsr//xlcdqYywPAOJQ6L5nBwZnTDArvk7awt6RpL4SIqWsQ==",
"hasInstallScript": true,
"license": "Apache-2.0",
"dependencies": {
"@aws-sdk/util-utf8-browser": "^3.259.0",
"@httptoolkit/websocket-stream": "^6.0.1",
"axios": "^1.12.2",
"buffer": "^6.0.3",
"crypto-js": "^4.2.0",
"mqtt": "^4.3.8",
"process": "^0.11.10"
}
},
"node_modules/axios": {
"version": "1.14.0",
"resolved": "https://registry.npmjs.org/axios/-/axios-1.14.0.tgz",
"integrity": "sha512-3Y8yrqLSwjuzpXuZ0oIYZ/XGgLwUIBU3uLvbcpb0pidD9ctpShJd43KSlEEkVQg6DS0G9NKyzOvBfUtDKEyHvQ==",
"license": "MIT",
"dependencies": {
"follow-redirects": "^1.15.11",
"form-data": "^4.0.5",
"proxy-from-env": "^2.1.0"
}
},Context
N/A