CVE-2025-4759: 
JavaScript vulnerability analysis and mitigation

CVE-2025-4759 affects versions of the package lockfile-lint-api before 5.9.2. The vulnerability was discovered on April 13, 2025, and publicly disclosed on May 15, 2025. This vulnerability is related to Incorrect Behavior Order: Early Validation in the package URL validation functionality (Snyk Advisory, Wiz Report).

The vulnerability exists in the resolved attribute of the package URL validation which can be bypassed by extending the package name. The issue stems from improper validation in ValidatePackageNames.js where the expected URL prefix check lacks a trailing slash. The vulnerability has been assigned a CVSS v4.0 score of 5.5 (Medium) and CVSS v3.1 score of 8.3 (High) (Snyk Advisory, GitHub Gist).

The vulnerability allows an attacker to bypass the package name validation, potentially leading to the installation of different npm packages than intended. This could result in supply chain attacks where malicious packages are installed instead of the legitimate ones (GitHub Gist).

The vulnerability has been fixed in version 5.9.2 of lockfile-lint-api by adding a trailing slash to the expected URL prefix for package validation. Users should upgrade to version 5.9.2 or higher to address this vulnerability (GitHub PR).