Hi, I got a report from XRay scanner in JFrog that the base image of discourse version 2.0.20240904-0335 contains malicious code in three packages dialog-holder:1.0.0 float-kit:1.0.0 custom-proxy:1.0.0 Then I did a little research also found the three packages with the same name and version reported on https://vulert.com (I will add this in the comment as I cannot post more than 2 links in the post) Have you faced the same issues before? Are these findings from Discourse or other packages as I cannot find any reported packages on npm.js? Many thanks :folded_hands:

dialog-holder:1.0.0: Malicious code in dialog-holder (npm) (vulert.com) and linked to data from OSV on github

float-kit:1.0.0: Malicious code in float-kit (npm) (vulert.com) and linked to data from OSV on github

custom-proxy:1.0.0: Malicious code in custom-proxy (npm) (vulert.com) and linked to data from OSV on github

We had seen something similar with JFrog. This looks to be an ambiguous name for an unscoped package and not an actual issue. Discourse does have a package in their repo called float-kit but that has nothing to do with the float-kit on npmjs. The others are basically the same. Ideally even these local packages would be scoped, but they are referenced from workspace so the 1.0.0 it is pulling is from its own repo. There is no provenance push that I have seen and JFrog just looks at names and versions in many cases so it should fall into your false positive handling process with the control.

[image] Security issues from automated scans Support Scans from off the shelf tools produce an absurd amount of false positives, which no one wants to waste time on. If you found an actual issue, please report via our Hacker One page, which is mostly in place so there is a layer that validates each report and ensure they aren’t invalid.

Noms et versions des paquets Npm signalés comme vulnérables

Assistance produit

Falco (Falco) Décembre 13, 2024, 12:43 6

Sujet		Réponses	Vues
Vulnerabilities in the official Docker image Development	1	945	Mai 19, 2023
Discourse updates - Microsoft Defender reports detection of Wacatac malware Product Support	7	409	Février 4, 2025
Vulnerability patching of npm/gem dependencies in discourse Self-hosting docker	2	228	Octobre 13, 2025
Security issues from automated scans Product Support	2	205	Octobre 15, 2024
Sucuri reports a malware infection? Product Support	5	2529	Juin 5, 2016

Noms et versions des paquets Npm signalés comme vulnérables

Sujets connexes