False-positive malware advisory for [email protected]

Abierto
  • ¿Algo no está bien?
#11,238 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
github-actions, go
Área
security

Línea de trabajo

Read the linked advisory GHSA-68q3-vw3h-2mrf and the release comparison for futrou/futrou-cli v2.0.39 to v2.0.40, then review the evidence in the issue against the advisory's classification. The requested outcome is to withdraw the advisory or mark it invalid; the issue does not name advisory-database files or tests to start from.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Hey everyone,
I'm the maintainer of the https://www.npmjs.com/package/futrou npm package.

The advisory https://github.com/advisories/GHSA-68q3-vw3h-2mrf incorrectly classifies the single [email protected] release as containing malicious code. The npm flagged and removed this specific version without any notice or explanation. I contacted npm support with a dispute after the advisory was published, but I have not received any response from them yet.

Supporting evidence:

  • No malicious code: Version 2.0.40 contains only a single commit from Dependabot updating github.com/quic-go/quic-go from 0.64.1 to 0.65.0. There were no other source code changes in this release and dependency itself has no CVE. As is visible in the changelog: futrou/[email protected]
  • No source code differences: Other older and newer published versions contain the same source code and functionality but were not flagged as malware.
  • Transparent build process: The entire source code and build process are publicly available for inspection. All binaries are built on shared GitHub Actions runners and signed.
  • NPM Provenance: all npm releases are published with npm Provenance, providing verifiable information about their origin and build process.
  • Pinned dependencies: Dependencies are pinned, and the repository does not accept merge requests from external collaborators, minimizing the risk of dependency or supply-chain attacks.
  • Scanner false positive finding: The only possible reason for this classification is that the package used the Garble minifier in its build process. Garble has now been removed to minimize the chances of any future false-positive flagging.

The advisory itself does not identify any specific malicious functionality or explain what code is considered malicious.
Please review the evidence and withdraw this false-positive advisory or mark as invalid.

Thank you

Links:

Lenguaje dominante
Sin datos de lenguaje
Estrellas
2.6k
Forks
916
Merge medio
6 d 3 h
PR fusionados (30 d)
170

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de github/advisory-database

Todos los issues de github/advisory-database

Issues similares

Más issues de Security

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.