Dependency version is unpinned
A package.json dependency uses '*' or 'latest', so every install can pull a different major version with no review. Pin a lower bound (or an exact version) so upgrades are a deliberate change.
medium likely application source OWASP A06:2021 / CWE-1104
How to fix it
Replace '*' or 'latest' with a lower-bounded range (or an exact version), then regenerate the lockfile.
Check your own repository
npx owlwarden scan --preset deep
npx owlwarden explain unpinned-dependency
explain prints the rule and fixes in the terminal. It does not
use the network.