Hi, I got a report from XRay scanner in JFrog that the base image of discourse version 2.0.20240904-0335 contains malicious code in three packages dialog-holder:1.0.0 float-kit:1.0.0 custom-proxy:1.0.0 Then I did a little research also found the three packages with the same name and version reported on https://vulert.com (I will add this in the comment as I cannot post more than 2 links in the post) Have you faced the same issues before? Are these findings from Discourse or other packages as I cannot find any reported packages on npm.js? Many thanks :folded_hands:

float-kit:1.0.0: Malicious code in float-kit (npm) (vulert.com) and linked to data from OSV on github

custom-proxy:1.0.0: Malicious code in custom-proxy (npm) (vulert.com) and linked to data from OSV on github

We had seen something similar with JFrog. This looks to be an ambiguous name for an unscoped package and not an actual issue. Discourse does have a package in their repo called float-kit but that has nothing to do with the float-kit on npmjs. The others are basically the same. Ideally even these local packages would be scoped, but they are referenced from workspace so the 1.0.0 it is pulling is from its own repo. There is no provenance push that I have seen and JFrog just looks at names and versions in many cases so it should fall into your false positive handling process with the control.

[image] Security issues from automated scans Support Scans from off the shelf tools produce an absurd amount of false positives, which no one wants to waste time on. If you found an actual issue, please report via our Hacker One page, which is mostly in place so there is a layer that validates each report and ensure they aren’t invalid.

Npm packages name and version reported in vulnerability

Product Support

qngo (Quang Ngo) September 6, 2024, 12:49pm 2

dialog-holder:1.0.0: Malicious code in dialog-holder (npm) (vulert.com) and linked to data from OSV on github

Topic		Replies	Views
Vulnerabilities in the official Docker image Development	1	945	May 19, 2023
Discourse updates - Microsoft Defender reports detection of Wacatac malware Product Support	7	411	February 4, 2025
Vulnerability patching of npm/gem dependencies in discourse Self-hosting docker	2	228	October 13, 2025
Security issues from automated scans Product Support	2	205	October 15, 2024
Sucuri reports a malware infection? Product Support	5	2529	June 5, 2016

Npm packages name and version reported in vulnerability

Related topics