False-positive malware advisory for [email protected]

Ouverte
  • Quelque chose ne va pas ?
#11,238 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
35/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
github-actions, go
Domaine
security

Piste de recherche

Read the linked advisory GHSA-68q3-vw3h-2mrf and the release comparison for futrou/futrou-cli v2.0.39 to v2.0.40, then review the evidence in the issue against the advisory's classification. The requested outcome is to withdraw the advisory or mark it invalid; the issue does not name advisory-database files or tests to start from.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Hey everyone,
I'm the maintainer of the https://www.npmjs.com/package/futrou npm package.

The advisory https://github.com/advisories/GHSA-68q3-vw3h-2mrf incorrectly classifies the single [email protected] release as containing malicious code. The npm flagged and removed this specific version without any notice or explanation. I contacted npm support with a dispute after the advisory was published, but I have not received any response from them yet.

Supporting evidence:

  • No malicious code: Version 2.0.40 contains only a single commit from Dependabot updating github.com/quic-go/quic-go from 0.64.1 to 0.65.0. There were no other source code changes in this release and dependency itself has no CVE. As is visible in the changelog: futrou/[email protected]
  • No source code differences: Other older and newer published versions contain the same source code and functionality but were not flagged as malware.
  • Transparent build process: The entire source code and build process are publicly available for inspection. All binaries are built on shared GitHub Actions runners and signed.
  • NPM Provenance: all npm releases are published with npm Provenance, providing verifiable information about their origin and build process.
  • Pinned dependencies: Dependencies are pinned, and the repository does not accept merge requests from external collaborators, minimizing the risk of dependency or supply-chain attacks.
  • Scanner false positive finding: The only possible reason for this classification is that the package used the Garble minifier in its build process. Garble has now been removed to minimize the chances of any future false-positive flagging.

The advisory itself does not identify any specific malicious functionality or explain what code is considered malicious.
Please review the evidence and withdraw this false-positive advisory or mark as invalid.

Thank you

Links:

Langage dominant
Aucune donnée de langage
Étoiles
2.6k
Forks
916
Merge moyen
6 j 3 h
PR mergées (30 j)
170

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de github/advisory-database

Toutes les issues de github/advisory-database

Issues similaires

Plus d'issues Security

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.