False-positive malware advisory for [email protected]
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Read the linked advisory GHSA-68q3-vw3h-2mrf and the release comparison for futrou/futrou-cli v2.0.39 to v2.0.40, then review the evidence in the issue against the advisory's classification. The requested outcome is to withdraw the advisory or mark it invalid; the issue does not name advisory-database files or tests to start from.
由索引模型根据 Issue 内容生成。
描述
Hey everyone,
I'm the maintainer of the https://www.npmjs.com/package/futrou npm package.
The advisory https://github.com/advisories/GHSA-68q3-vw3h-2mrf incorrectly classifies the single [email protected] release as containing malicious code. The npm flagged and removed this specific version without any notice or explanation. I contacted npm support with a dispute after the advisory was published, but I have not received any response from them yet.
Supporting evidence:
- No malicious code: Version
2.0.40contains only a single commit from Dependabot updatinggithub.com/quic-go/quic-gofrom0.64.1to0.65.0. There were no other source code changes in this release and dependency itself has no CVE. As is visible in the changelog: futrou/[email protected] - No source code differences: Other older and newer published versions contain the same source code and functionality but were not flagged as malware.
- Transparent build process: The entire source code and build process are publicly available for inspection. All binaries are built on shared GitHub Actions runners and signed.
- NPM Provenance: all npm releases are published with npm Provenance, providing verifiable information about their origin and build process.
- Pinned dependencies: Dependencies are pinned, and the repository does not accept merge requests from external collaborators, minimizing the risk of dependency or supply-chain attacks.
- Scanner false positive finding: The only possible reason for this classification is that the package used the Garble minifier in its build process. Garble has now been removed to minimize the chances of any future false-positive flagging.
The advisory itself does not identify any specific malicious functionality or explain what code is considered malicious.
Please review the evidence and withdraw this false-positive advisory or mark as invalid.
Thank you
Links:
- Repository: https://github.com/futrou/futrou-cli
- Disputed advisory: https://github.com/advisories/GHSA-68q3-vw3h-2mrf
- NPM package and version history: https://www.npmjs.com/package/futrou?activeTab=versions
- Affected release: https://github.com/futrou/futrou-cli/releases/tag/v2.0.40
- 主要语言
- 没有语言数据
- 星标
- 2.6k
- 派生
- 916
- 平均合并
- 6 天 3 小时
- 30 天内合并 PR
- 170
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/advisory-database 的其他 Issue
-
[GHSA-gcqx-w48m-w2h4] False positive - CVE-2026-93753 is already rejected可能已有人在做 @apepper 于 3 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
github/advisory-database#10910 · 12 个 reaction ·
维护者通常 1 天内回复
-
Update https://github.com/advisories/GHSA-5pf6-cq2v-23ww to include patched version可能已有人在做 @GreyforgeLabs 于 42 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 76/100
github/advisory-database#9879 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
github/advisory-database#9255 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
github/advisory-database#9164 · 1 个 reaction ·
维护者通常 1 天内回复
-
CVE-2026-5598 has incorrect fixed versions for bcprov-jdk packages可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
github/advisory-database#8994 ·
维护者通常 1 天内回复
查看 github/advisory-database 的全部 Issue
相似的 Issue
-
blocklist addition
难度 2/5 1-3 小时 新手友好度 72/100
MetaMask/eth-phishing-detect#312343 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
-
难度 2/5 1-3 小时 新手友好度 70/100
Cygnux-Labs/Tracekit#827 ·
维护者通常 1 天内回复
-
enhancement
难度 2/5 1-3 小时 新手友好度 82/100
MaximeMRF/adonisjs-jwt#99 ·