Security Issue: Risk of Dependency Confusion with `scancode-workbench`

Abierto
  • ¿Algo no está bien?
#635 4 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
42/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
typescript
Área
build-system, security

Línea de trabajo

Comienza con package.json y verifica cómo se denomina e incluye scancode-workbench; después, comprueba la URL vinculada del registro npm. Confirma con las personas mantenedoras si el paquete debe ser privado o si se debe reclamar su nombre; se considera terminado cuando se ha aplicado la protección elegida y el flujo de trabajo de gestión de paquetes ya no deja este nombre expuesto a dependency confusion.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Description

I have identified a potential security risk related to a Dependency Confusion vulnerability within our project. Our package.json refers to the package named scancode-workbench, which, according to our findings, does not exist on the public npm registry. This poses a risk that a malicious package could be uploaded to npm with the same name, leading our build systems to accidentally pull and use the malicious package instead of our intended local or private repository package.

Affected Package

Package Name: scancode-workbench
Current Usage: Referenced in package.json as the project name and included as a dependency.
Version: 4.0.3

Risk Impact

If an attacker were to upload a malicious package to npm under the scancode-workbench name with a higher version number, they could execute arbitrary code within our systems or steal sensitive data, depending on how the package is utilized within our projects.
Every single time anyone would use the command npm install pkg name, the malicious package would be fetched. Even in automated pipelines, the higher version number of the malicious package on the public registry would cause a public vs private dependency confusion and might make systems fetch the malicious version of our package.

Steps to Reproduce
  1. Check the npm registry for scancode-workbench: [(https://registry.npmjs.org/scancode-workbench)]
  2. Observe that the package does not exist on npm, presenting a risk for dependency confusion attacks.
Proposed Solutions

To mitigate this risk, we have a couple of options:

  1. Claim the Package Name on npm: By claiming the package name on npm, we can prevent unauthorized parties from uploading a malicious package with the same name. This involves creating a minimal, benign package under the scancode-workbench name to reserve it.

  2. Mark the Package as Private: If the package is intended for internal use only and not meant to be published, we should specify this in our package.json by adding "private": true. This ensures that npm will refuse to publish it, avoiding any accidental exposure.

    Example:

    {
  "name": "scancode-workbench",
  "version": "4.0.3",
  "private": true,
  "description": "An application for viewing ScanCode results and concluding component origin and license"
}
Action Required
  • Decide on claiming the package name or marking it as private.
  • Implement the chosen solution to secure our package management workflow.
Additional Information
  • Reviewing our internal dependency management policies to avoid similar issues in the future.
  • Ensuring all developers are aware of the implications of public vs. private packages in npm.
Lenguaje dominante
TypeScript
Estrellas
174
Forks
81
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de aboutcode-org/scancode-workbench

Todos los issues de aboutcode-org/scancode-workbench

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.