Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Update NIST CPE Dictionary

Open
#3 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Domain
security

Research direction

Start with the issue's NIST CPE Dictionary links and the proposed CPE identifiers for LoopBack and related packages. Determine which entries should be revoked, replaced, or added, then confirm the final naming with NIST; done means the agreed CPE records are registered and the repository's security guidance reflects them.

Written by the indexing model from the issue text.

Description

CPE (Common Platform Enumeration) is a standard syntax for describing software (e.g. vendor, software type, software name, version).

The NIST CPE Dictionary is a central database of registered CPEs. Vendors can register their CPEs with NIST to be added to the database.

Currently, LoopBack only has 1 CPE entry, cpe:2.3:a:ibm:loopback:8.0.0:*:*:*:*:*:*:*.

Here is a 3-part proposal:

  1. IBM is no longer the vendor for LoopBack
    To solve this, we can revoke the current CPE and replace it with the following:
    cpe:2.3:a:loopback:\@loopback\/rest:8.0.0:*:*:*:*:*:*:*
    Note that the CPE above is not registered and may change once we contact NIST. The backslash is used to "quote" printable, non-alphanmuric characters in accordance with the CPE 2.3 specification.
  2. Other vulnerable LoopBack packages with a published CVE do not have an associated CPE.
    LB2/3 is quite different from LB4. Hence one proposal is to utilise the DefinitelyTyped syntax by:
    a. Replacing the above CPE with double underscore
    b. Use hyphen as per-normal for LB2/3 packages (e.g. loopback-boot)
    This allows us to exploit the existing distinctive property separating LB2/3 and LB4, that LB2/3 packages are unscoped while LB4 packages are scoped.
  3. For "non-LoopBack" packages such as strong-soap, keep the loopback vendor and use the package name as per-normal, similar to 2.a.
Dominant language
TypeScript
Stars
4
Forks
1
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from loopbackio/security

All issues in loopbackio/security

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.