False-positive malware advisory for [email protected]

Aperta
  • Qualcosa non va?
#11,238 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
github-actions, go
Ambito
security

Direzione di ricerca

Read the linked advisory GHSA-68q3-vw3h-2mrf and the release comparison for futrou/futrou-cli v2.0.39 to v2.0.40, then review the evidence in the issue against the advisory's classification. The requested outcome is to withdraw the advisory or mark it invalid; the issue does not name advisory-database files or tests to start from.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Hey everyone,
I'm the maintainer of the https://www.npmjs.com/package/futrou npm package.

The advisory https://github.com/advisories/GHSA-68q3-vw3h-2mrf incorrectly classifies the single [email protected] release as containing malicious code. The npm flagged and removed this specific version without any notice or explanation. I contacted npm support with a dispute after the advisory was published, but I have not received any response from them yet.

Supporting evidence:

  • No malicious code: Version 2.0.40 contains only a single commit from Dependabot updating github.com/quic-go/quic-go from 0.64.1 to 0.65.0. There were no other source code changes in this release and dependency itself has no CVE. As is visible in the changelog: futrou/[email protected]
  • No source code differences: Other older and newer published versions contain the same source code and functionality but were not flagged as malware.
  • Transparent build process: The entire source code and build process are publicly available for inspection. All binaries are built on shared GitHub Actions runners and signed.
  • NPM Provenance: all npm releases are published with npm Provenance, providing verifiable information about their origin and build process.
  • Pinned dependencies: Dependencies are pinned, and the repository does not accept merge requests from external collaborators, minimizing the risk of dependency or supply-chain attacks.
  • Scanner false positive finding: The only possible reason for this classification is that the package used the Garble minifier in its build process. Garble has now been removed to minimize the chances of any future false-positive flagging.

The advisory itself does not identify any specific malicious functionality or explain what code is considered malicious.
Please review the evidence and withdraw this false-positive advisory or mark as invalid.

Thank you

Links:

Lingua principale
Nessun dato sulla lingua
Stelle
2.6k
Fork
916
Merge medio
6g 6h
PR unite (30g)
171

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di github/advisory-database

Tutte le issue di github/advisory-database

Issue simili

Altre issue su Security

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.