GHSA-2jcg-qqmg-46q6 monorepo-symlink-test placeholder version false positive

Open Beginner friendly
#9,164 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
javascript
Domain
security

Research direction

Locate the GHSA-2jcg-qqmg-46q6 advisory entry in the advisory database and inspect how affected versions are represented. Exclude version 0.0.1-security for monorepo-symlink-test, then validate that the advisory data no longer reports this placeholder version as affected.

Written by the indexing model from the issue text.

Description

The package monorepo-symlink-test currently has version 0.0.1-security which is a placeholder for the previously removed package on npm registry. This is being reported as malware via GHSA-2jcg-qqmg-46q6 which is a false positive.

It would be good to exclude the 0.0.1-security placeholder version from the advisory.

Dominant language
No language data
Stars
2.5k
Forks
772
Avg merge
3d 18h
Merged PRs (30d)
48

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/advisory-database

All issues in github/advisory-database

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.