Published npm package includes www-v2/ directory with stale package-lock.json triggering CVE false positives

Open Beginner friendly
#267 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
84/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
javascript
Domain
release

Research direction

Start by reading the package.json publication settings and checking whether a .npmignore file exists. Inspect the generated npm tarball to confirm that www-v2/ and its stale package-lock.json are excluded while dist/, lib/, and top-level JavaScript files remain available.

Written by the indexing model from the issue text.

Description

Problem

The published npm package includes the www-v2/ directory which contains the project's demo website source code. This directory includes a package-lock.json that references next@12.1.6.

Container vulnerability scanners (e.g. AWS ECR Enhanced Scanning / Amazon Inspector) scan all lock files in the image and flag this as CVE-2025-29927 (critical severity — Next.js middleware authorization bypass).

This is a false positive — the next@12.1.6 is not installed, not executable, and not part of any consumer's dependency tree. It's just a string in a lock file that happens to ship with the package.

Impact

Consumers using third-party-web (typically via lighthouse / @lhci/cli) get critical vulnerability alerts in their container scanning pipelines for code that has nothing to do with their application.

Suggested Fix

Add www-v2/ to .npmignore (or use the files field in package.json) so the demo website source isn't included in the published tarball. The actual package exports (dist/, lib/, top-level .js files) would remain unaffected.

Workaround

We currently rm -rf node_modules/third-party-web/www-v2 in our Dockerfile after install.

Dominant language
JavaScript
Stars
1.1k
Forks
112
Avg merge
22h 26m
Merged PRs (30d)
1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from patrickhulce/third-party-web

All issues in patrickhulce/third-party-web

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.