Find, Fix, Verify: student worksheet
CVE Lite Classroom · Classroom repository · CVE Lite CLI
In a student kit, read MANAGER-SETUP.md and enter app/. In the source repository, read examples/
Before step 1: read DEPENDENCY-BASICS.md in your kit, or docs/dependency-basics.md at the full repository root. Allow 15–20 minutes if this is your first dependency-security lesson. Complete its four understanding questions before interpreting the report. The primer explains the field names and version decisions below; you do not need to understand every field in the full JSON.
- Open the supplied app's package.json and source. Explain what lodash and axios do here. Run the app and its four tests using MANAGER-SETUP.md.
- Use the manager's dependency-tree command. Identify axios and lodash as direct dependencies and trace axios → follow-redirects. A transitive dependency is not automatically vulnerable.
- Run the supplied scan command. Save its JSON. Record status, complete, packageCount, findingCount and each finding's relationship. Count vulnerable packages separately from advisory identifiers.
- Choose one advisory attached to axios and one attached to lodash. Open https://github.com/advisories/
using the exact ID in the report. Explain affected versions, suggested remediation and what is or is not demonstrated about this app's exposure. - Read suggestedFixCommands and runnableFixCommand. Propose a fix, justify any major upgrade and predict compatibility risks. Obtain approval before editing.
- Apply your selected manager's add/install command with exact reviewed versions and lifecycle scripts disabled. Keep both manifest and lockfile. Inspect their diff; do not add a second manager lockfile.
- Run the application tests and the app again. Rescan. Compare findings, graph changes and behavior. Explain any remaining findings or incomplete lookup.
- Submit your evidence. Explain why four passing tests plus zero known findings do not establish universal compatibility or security.