Security Issue: Risk of Dependency Confusion with `scancode-workbench`

オープン
  • 何か問題がありますか？
#635 コメント 4 件 リアクション 0 件 担当者 0 名 GitHub で見る

まだ誰も着手していません。

評価

難易度
2/5
見積もり時間
1〜3時間
初心者へのやさしさ
42/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
停滞
技術スタック
typescript
領域
build-system, security

調査の方向性

package.json から始めて、scancode-workbench がどのような名前で、どのように含まれているかを確認し、次にリンク先の npm レジストリ URL を確認します。パッケージを private にすべきか、またはその名前を確保すべきかをメンテナーに確認してください。選択した保護が適用され、パッケージ管理ワークフローによってこの名前が dependency confusion にさらされなくなれば完了です。

索引モデルが issue の本文から書いたものです。

説明

Description

I have identified a potential security risk related to a Dependency Confusion vulnerability within our project. Our package.json refers to the package named scancode-workbench, which, according to our findings, does not exist on the public npm registry. This poses a risk that a malicious package could be uploaded to npm with the same name, leading our build systems to accidentally pull and use the malicious package instead of our intended local or private repository package.

Affected Package

Package Name: scancode-workbench
Current Usage: Referenced in package.json as the project name and included as a dependency.
Version: 4.0.3

Risk Impact

If an attacker were to upload a malicious package to npm under the scancode-workbench name with a higher version number, they could execute arbitrary code within our systems or steal sensitive data, depending on how the package is utilized within our projects.
Every single time anyone would use the command npm install pkg name, the malicious package would be fetched. Even in automated pipelines, the higher version number of the malicious package on the public registry would cause a public vs private dependency confusion and might make systems fetch the malicious version of our package.

Steps to Reproduce
  1. Check the npm registry for scancode-workbench: [(https://registry.npmjs.org/scancode-workbench)]
  2. Observe that the package does not exist on npm, presenting a risk for dependency confusion attacks.
Proposed Solutions

To mitigate this risk, we have a couple of options:

  1. Claim the Package Name on npm: By claiming the package name on npm, we can prevent unauthorized parties from uploading a malicious package with the same name. This involves creating a minimal, benign package under the scancode-workbench name to reserve it.

  2. Mark the Package as Private: If the package is intended for internal use only and not meant to be published, we should specify this in our package.json by adding "private": true. This ensures that npm will refuse to publish it, avoiding any accidental exposure.

    Example:

    {
  "name": "scancode-workbench",
  "version": "4.0.3",
  "private": true,
  "description": "An application for viewing ScanCode results and concluding component origin and license"
}
Action Required
  • Decide on claiming the package name or marking it as private.
  • Implement the chosen solution to secure our package management workflow.
Additional Information
  • Reviewing our internal dependency management policies to avoid similar issues in the future.
  • Ensuring all developers are aware of the implications of public vs. private packages in npm.
主要言語
TypeScript
スター
174
フォーク
81
30日以内にマージされた PR はありません

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

aboutcode-org/scancode-workbench のほかの issue

aboutcode-org/scancode-workbench の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。