es5-ext dependency is quarantined by Nexus Firewall, blocking hermetic builds
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 68/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- typescript, vscode
- Domain
- build-system, devops
Research direction
Start in lib/vscode/package.json and trace the listed dependency chain to confirm how es5-ext is resolved. Apply the dependency override described in the issue, then run the hermetic or hardened dependency-fetch build to verify that the quarantined package is no longer requested.
Written by the indexing model from the issue text.
Description
Problem
The es5-ext npm package (both 0.10.63 and 0.10.64) has been quarantined by Nexus Firewall under advisory sonatype-2022-2248. Its _postinstall.js script makes network calls to geolocate the host and executes undisclosed code (classified as protestware). Both versions are flagged; there is no clean upstream version.
This blocks any hermetic/hardened supply chain build that prefetches npm dependencies through an artifact registry proxy, resulting in:
FetchError: 403, message='--- Requested item is quarantined ---'
url='https://artifact-registry-proxy.../npm-proxy/es5-ext/-/es5-ext-0.10.63.tgz'
Dependency chain
es5-ext enters code-server through the VS Code submodule (lib/vscode/):
gulp-sourcemaps→debug-fabulous→memoizee→es5-ext(build tooling, devDependency)- Also via
d,es6-iterator,es6-symbol,es6-weak-map,esniff,event-emitter,timers-ext
Upstream status
- microsoft/vscode#310541 — closed, maintainer said PRs welcome
- microsoft/vscode#160012 — older duplicate, also closed
- medikoo/es5-ext#186 — upstream protestware discussion (4 years old)
Suggested fix
Add an npm overrides entry in lib/vscode/package.json to alias es5-ext to @unes/es5-ext, a community fork that strips the postinstall script and rebases daily against upstream:
"overrides": {
"es5-ext": "npm:@unes/es5-ext@0.10.64-1"
}
We have implemented this fix in our downstream build at opendatahub-io/notebooks#3556.
- Dominant language
- TypeScript
- Stars
- 79.4k
- Forks
- 6.9k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 39
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from coder/code-server
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
coder/code-server#8017 · 2 comments ·
-
security
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
coder/code-server#8013 · 4 comments ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 35/100
coder/code-server#7976 · 2 comments ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 35/100
coder/code-server#7962 · 3 comments ·
-
bug needs-investigation
Difficulty 4/5 3-5 days Newbie friendliness 55/100
coder/code-server#7955 · 1 comment ·
All issues in coder/code-server
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
vercel-labs/just-bash#464 ·
-
looksLikeSlug() is ASCII-only, so non-Latin entity slugs (e.g. Korean) skip exact match and collapse Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
TanStack/tanstack.com#1293 ·