Hi, I got a report from XRay scanner in JFrog that the base image of discourse version 2.0.20240904-0335 contains malicious code in three packages dialog-holder:1.0.0 float-kit:1.0.0 custom-proxy:1.0.0 Then I did a little research also found the three packages with the same name and version repo…

float-kit:1.0.0: Malicious code in float-kit (npm) (vulert.com) and linked to data from OSV on github

custom-proxy:1.0.0: Malicious code in custom-proxy (npm) (vulert.com) and linked to data from OSV on github

We had seen something similar with JFrog. This looks to be an ambiguous name for an unscoped package and not an actual issue. Discourse does have a package in their repo called float-kit but that has nothing to do with the float-kit on npmjs. The others are basically the same. Ideally even these…

[image] Security issues from automated scans Support Scans from off the shelf tools produce an absurd amount of false positives, which no one wants to waste time on. If you found an actual issue, please report via our Hacker One page, which is mostly in p…

Npm packages name and version reported in vulnerability

Product Support

qngo (Quang Ngo) September 6, 2024, 12:49pm 2

dialog-holder:1.0.0: Malicious code in dialog-holder (npm) (vulert.com) and linked to data from OSV on github

Topic		Replies	Views
Vulnerabilities in the official Docker image Development	1	937	May 19, 2023
Discourse updates - Microsoft Defender reports detection of Wacatac malware Product Support	7	384	February 4, 2025
Vulnerability patching of npm/gem dependencies in discourse Self-hosting docker	2	216	October 13, 2025
Security issues from automated scans Product Support	2	197	October 15, 2024
Sucuri reports a malware infection? Product Support	5	2524	June 5, 2016

Npm packages name and version reported in vulnerability

Related topics