Hi, I got a report from XRay scanner in JFrog that the base image of discourse version 2.0.20240904-0335 contains malicious code in three packages dialog-holder:1.0.0 float-kit:1.0.0 custom-proxy:1.0.0 Then I did a little research also found the three packages with the same name and version repo…

dialog-holder:1.0.0: Malicious code in dialog-holder (npm) (vulert.com) and linked to data from OSV on github

float-kit:1.0.0: Malicious code in float-kit (npm) (vulert.com) and linked to data from OSV on github

custom-proxy:1.0.0: Malicious code in custom-proxy (npm) (vulert.com) and linked to data from OSV on github

We had seen something similar with JFrog. This looks to be an ambiguous name for an unscoped package and not an actual issue. Discourse does have a package in their repo called float-kit but that has nothing to do with the float-kit on npmjs. The others are basically the same. Ideally even these…

[תמונה] Security issues from automated scans Support Scans from off the shelf tools produce an absurd amount of false positives, which no one wants to waste time on. If you found an actual issue, please report via our Hacker One page, which is mostly in place so there is …

שמות גרסאות החבילות ב-Npm והדוחות על פגיעויות

תמיכה

Falco (Falco) 13 בדצמבר,‏ 2024,‏ 12:43pm 6

נושא		תגובות	צפיות
Vulnerabilities in the official Docker image Development	1	874	19 במאי,‏ 2023
Discourse updates - Microsoft Defender reports detection of Wacatac malware Support	7	222	4 בפברואר,‏ 2025
Vulnerability patching of npm/gem dependencies in discourse Self-hosting docker	2	111	13 באוקטובר,‏ 2025
Security issues from automated scans Support	2	129	15 באוקטובר,‏ 2024
Sucuri reports a malware infection? Support	6	2439	8 ביוני,‏ 2024

שמות גרסאות החבילות ב-Npm והדוחות על פגיעויות

נושאים קשורים