Many security_advisory.published failing webhook events originating from similar npm packages
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
Research direction
Start with the linked GitHub security_advisory webhook documentation and the example GHSA-hh4g-p2q6-7fv advisory. Compare the reported malware advisories with the failing webhook events and X-Hub-Signature-256 behavior. Done means documenting whether these advisories should be delivered generally and clarifying or correcting the reported signature failure.
Written by the indexing model from the issue text.
Description
My github org is currently receiving many webhooks of the security_advisory.published type. My understanding is that these advisories are general in nature and are not necessarily received due to a specific package being used within an org (please correct me if wrong).
The reason I'm raising this is that there appear to be many junk malware type advisories being pushed out through the database:
see: https://github.com/advisories?query=type%3Amalware
example advisory: https://github.com/advisories/GHSA-hh4g-p2q6-7fvj
These advisories would need to be reviewed before being sent out, is that correct? An interesting note is that these events are also all failing the X-Hub-Signature-256 check for the github app installed in my org receiving the webhook events
- Dominant language
- No language data
- Stars
- 2.5k
- Forks
- 772
- Avg merge
- 3d 15h
- Merged PRs (30d)
- 46
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/advisory-database
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/advisory-database#9255 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#9164 · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#8994 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/advisory-database#8898 · 4 comments · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#8841 ·
All issues in github/advisory-database
Similar issues
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Automattic/safe-publish#593 ·
-
area/plugin
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
kestra-io/plugin-kestra#190 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
xinnan-tech/xiaozhi-fde-talk#263 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
pending-maintainer-response pending-triage
Difficulty 2/5 1-3 hours Newbie friendliness 75/100