Recognised package-CDN script has no integrity attribute
ShipReady found a supported public package-CDN script tag without an integrity attribute.
Why it matters
A missing integrity attribute is a static supply-chain review signal, not a demonstration that a resource was altered.
How ShipReady detects it
What it inspects
ShipReady inspects static script tags whose source host is in its maintained package-CDN list.
What triggers a finding
A supported package-CDN script has no integrity attribute; unique URLs are capped across SRI findings.
What the evidence shows
The inspected HTML references a supported package-CDN script without an integrity attribute.
Limits of this check
ShipReady does not fetch or execute the script, verify resource immutability, test browser enforcement, or prove a supply-chain compromise.
How to fix it
Review whether the script can be pinned with SRI
Confirm that the recognised package CDN publishes a stable integrity value for the exact script URL before adding SRI. If it does, add the documented integrity value and any required crossorigin setting to the deployed script tag.
How to verify the change
Inspect the deployed script tag
Fetch the affected page and confirm the recognised package-CDN script has the intended non-empty integrity attribute. Test the integration separately after any pinning change.
Expected: The returned HTML contains the intended script integrity attribute.