advisory-database

advisory-database copied to clipboard

Private NPM appearing as malware in public repo

3

Greetings, I see a large influx of similar issues like this so sorry for only on to the pile. It looks like a private, and only internally used `npm` package...

HarlowIBM

GHSA-w687-f44x-x42j false positive?

5

We received a dependabot alert about this advisory: https://github.com/advisories/GHSA-w687-f44x-x42j It's very strange, because this isn't an NPM package - it's a built-in element of the Unity game engine and is...

cgauld

github hosted package with shadow npm version is being flagged in our repos as malware

7

We have a package in a private github packages repo called @contrast-security-inc/design-system-foundations. Somehow a package was also published to NPM https://www.npmjs.com/package/@contrast-security-inc/design-system-foundations The NPM team flagged this as containing malware. We've...

scottdickerson

Our private github packages are showing up as malware

1

Related to https://github.com/github/advisory-database/issues/422 We started getting this dependabot alert https://github.com/advisories/GHSA-9824-332p-264p. It's unclear why this has happened, and I'm unsure how to resolve this. In the other issue the creator mentions...

martintreurnicht

If you're harnessing this database, we want to talk!

3

Hi all, First of all, thanks for being participants in the GitHub Advisory Database! Your contributions make our community safer and stronger. If you are consuming this database in some...

KateCatlin

Should advisories be issued for python ctx and PHP phpass packages?

5

There is [a tweet](https://twitter.com/s0md3v/status/1529005758540808192?s=21&t=SkR4KmTGPfmeJ1jVwmtLyg) making headlines about some malicious code discovered in some abandoned python and PHP packages. Does it make since to create GitHub advisory records for these? I...

westonsteimel

**Release Notes Persisted** > Fixed an issue where `BrowserWindow#isFocused()` was returning `false` when `blur()` was called on macOS. __Originally posted by @release-clerk in https://github.com/electron/electron/pull/34030#issuecomment-1116990971__

taylorlwileczek

Rebuttal for GHSA-27rq-4943-qcwp (CVE-2022-29810)

3

👋 Hello! I work on the Product Security Team at HashiCorp that handles the vulnerability management and response process. I am reaching out on behalf of my team in response...

picatz

GHSA-qq97-vm5h-rrhg out-of sync. Why does it have different states?

3

When analyzing https://github.com/aquasecurity/trivy/issues/2034 I was surprised to find the advisory id GHSA-qq97-vm5h-rrhg in two different states: 1. https://github.com/distribution/distribution/security/advisories/GHSA-qq97-vm5h-rrhg from the repo maintainers which seems to be the most up-to-date version,...

mayrstefan

Ecosystem field unclear for things that are not npm/rust/...

9

Hi, I just found out the ecosystem thingy is mandatory to put in affected versions. Is there a reason/need behind that? Because for example, WordPress plugins are in the database,...

MTRNord