[FP]: pkg:npm/opener

[SkippedTurn]

Package URl

pkg:npm/[email protected]

CPE

cpe:2.3:a:opener_project:opener:1.5.2:*:*:*:*:*:*:*

CVE

CVE-2021-27478, CVE-2021-27482, CVE-2021-27498, CVE-2021-27500

ODC Integration

{"label"=>"Maven Plugin"}

ODC Version

7.1.0

Description

The mentioned vulnerabilities are present in the EIPStackGroup/OpENer library, not in the npm opener package mentioned in this report.

[github-actions[bot]]

Npm Coordinates

npm -i [email protected]

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #4525
   ]]></notes>
   <packageUrl regex="true">^pkg:npm/opener@.*$</packageUrl>
   <cpe>cpe:/a:opener_project:opener</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/2377401722

[JoergHeinicke5005]

Any intention to address this false positive?

[jjoshm]

can we get an update on this? the latest NPM version itself has opener installed so it is really annoying