Homepage

@hulumi/drift@1.2.0

Local-first drift classifier and live posture validator — distinguishes provider-API churn from console break-glass from genuine IaC drift, then renders read-only live posture findings as JSON, Markdown, and SARIF. Verdict logic mirrors HulumiDrift.tla Ha

  • latest version

    1.5.0

  • latest non vulnerable version

    1.5.0

  • first published

    2 months ago

  • latest version published

    1 months ago

  • licenses detected

  • View drift package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @hulumi/drift package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Insufficient Verification of Data Authenticity

    @hulumi/drift is a Local-first drift classifier and live posture validator — distinguishes provider-API churn from console break-glass from genuine IaC drift, then renders read-only live posture findings as JSON, Markdown, and SARIF. Verdict logic mirrors HulumiDrift.tla Ha

    Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the execute-plan process. An attacker can cause unsafe input to be treated as trusted by supplying externally crafted execute plans without sufficient provenance checks.

    How to fix Insufficient Verification of Data Authenticity?

    Upgrade @hulumi/drift to version 1.3.2 or higher.

    <1.3.2
    • H
    Improper Handling of Exceptional Conditions

    @hulumi/drift is a Local-first drift classifier and live posture validator — distinguishes provider-API churn from console break-glass from genuine IaC drift, then renders read-only live posture findings as JSON, Markdown, and SARIF. Verdict logic mirrors HulumiDrift.tla Ha

    Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions due to improper handling of exceptional conditions in the classifier process. An attacker can cause legitimate drift detection results to be masked or false incident escalations to occur by triggering adapter failures or exploiting normal provider-API churn. This is only exploitable if the classifier is used in environments where verdicts are relied upon for incident workflows and adapter failures can occur.

    How to fix Improper Handling of Exceptional Conditions?

    Upgrade @hulumi/drift to version 1.4.0 or higher.

    <1.4.0
    Go back to all versions of this package