False-positive malware advisory for [email protected]
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
Read the linked advisory GHSA-68q3-vw3h-2mrf and the release comparison for futrou/futrou-cli v2.0.39 to v2.0.40, then review the evidence in the issue against the advisory's classification. The requested outcome is to withdraw the advisory or mark it invalid; the issue does not name advisory-database files or tests to start from.
由索引模型根據 Issue 內容生成。
描述
Hey everyone,
I'm the maintainer of the https://www.npmjs.com/package/futrou npm package.
The advisory https://github.com/advisories/GHSA-68q3-vw3h-2mrf incorrectly classifies the single [email protected] release as containing malicious code. The npm flagged and removed this specific version without any notice or explanation. I contacted npm support with a dispute after the advisory was published, but I have not received any response from them yet.
Supporting evidence:
- No malicious code: Version
2.0.40contains only a single commit from Dependabot updatinggithub.com/quic-go/quic-gofrom0.64.1to0.65.0. There were no other source code changes in this release and dependency itself has no CVE. As is visible in the changelog: futrou/[email protected] - No source code differences: Other older and newer published versions contain the same source code and functionality but were not flagged as malware.
- Transparent build process: The entire source code and build process are publicly available for inspection. All binaries are built on shared GitHub Actions runners and signed.
- NPM Provenance: all npm releases are published with npm Provenance, providing verifiable information about their origin and build process.
- Pinned dependencies: Dependencies are pinned, and the repository does not accept merge requests from external collaborators, minimizing the risk of dependency or supply-chain attacks.
- Scanner false positive finding: The only possible reason for this classification is that the package used the Garble minifier in its build process. Garble has now been removed to minimize the chances of any future false-positive flagging.
The advisory itself does not identify any specific malicious functionality or explain what code is considered malicious.
Please review the evidence and withdraw this false-positive advisory or mark as invalid.
Thank you
Links:
- Repository: https://github.com/futrou/futrou-cli
- Disputed advisory: https://github.com/advisories/GHSA-68q3-vw3h-2mrf
- NPM package and version history: https://www.npmjs.com/package/futrou?activeTab=versions
- Affected release: https://github.com/futrou/futrou-cli/releases/tag/v2.0.40
- 主要語言
- 沒有語言資料
- 星號
- 2.6k
- 分支
- 916
- 平均合併
- 6 天 3 小時
- 30 天內合併 PR
- 170
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
github/advisory-database 的其他 Issue
-
[GHSA-gcqx-w48m-w2h4] False positive - CVE-2026-93753 is already rejected可能已有人在做 @apepper 於 3 天前認領。 未關閉
難度 2/5 1-3 小時 新手友好度 72/100
github/advisory-database#10910 · 12 個 reaction ·
維護者通常 1 天內回覆
-
Update https://github.com/advisories/GHSA-5pf6-cq2v-23ww to include patched version可能已有人在做 @GreyforgeLabs 於 42 天前認領。 未關閉
難度 2/5 1-3 小時 新手友好度 76/100
github/advisory-database#9879 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 68/100
github/advisory-database#9255 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 72/100
github/advisory-database#9164 · 1 個 reaction ·
維護者通常 1 天內回覆
-
CVE-2026-5598 has incorrect fixed versions for bcprov-jdk packages可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉
難度 2/5 1-3 小時 新手友好度 72/100
github/advisory-database#8994 ·
維護者通常 1 天內回覆
查看 github/advisory-database 的全部 Issue
相似的 Issue
-
blocklist addition
難度 2/5 1-3 小時 新手友好度 72/100
MetaMask/eth-phishing-detect#312343 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 78/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 72/100
-
難度 2/5 1-3 小時 新手友好度 70/100
Cygnux-Labs/Tracekit#827 ·
維護者通常 1 天內回覆
-
enhancement
難度 2/5 1-3 小時 新手友好度 82/100
MaximeMRF/adonisjs-jwt#99 ·