Npm packages name and version reported in vulnerability

Product Support

AI-generated summary

The discussion is about Npm packages name and version reported in vulnerability. qngo received a report from XRay scanner in JFrog indicating that the base image of Discourse version 2.0.20240904-0335 contains malicious code in three packages:

  • dialog-holder:1.0.0
  • float-kit:1.0.0
  • custom-proxy:1.0.0.
    qngo provided links to vulert.com for each package, which report malicious code.
    However, jrack suggested that this is likely a false positive, as the packages in question are local and not the same as those on npmjs.
    Additionally, jrack mentioned that Discourse does have a package called float-kit in their repo, but it is not related to the float-kit on npmjs.
    Falco referenced a related discussion on meta.discourse.org.
1

Hi,

I got a report from XRay scanner in JFrog that the base image of discourse version 2.0.20240904-0335 contains malicious code in three packages

  • dialog-holder:1.0.0
  • float-kit:1.0.0
  • custom-proxy:1.0.0

Then I did a little research also found the three packages with the same name and version reported on https://vulert.com

(I will add this in the comment as I cannot post more than 2 links in the post)

Have you faced the same issues before? Are these findings from Discourse or other packages as I cannot find any reported packages on npm.js?

Many thanks :folded_hands:

2

dialog-holder:1.0.0: Malicious code in dialog-holder (npm) (vulert.com) and linked to data from OSV on github

3

float-kit:1.0.0: Malicious code in float-kit (npm) (vulert.com) and linked to data from OSV on github

4

custom-proxy:1.0.0: Malicious code in custom-proxy (npm) (vulert.com) and linked to data from OSV on github

5

We had seen something similar with JFrog. This looks to be an ambiguous name for an unscoped package and not an actual issue.

Discourse does have a package in their repo called float-kit but that has nothing to do with the float-kit on npmjs. The others are basically the same.

Ideally even these local packages would be scoped, but they are referenced from workspace so the 1.0.0 it is pulling is from its own repo.

There is no provenance push that I have seen and JFrog just looks at names and versions in many cases so it should fall into your false positive handling process with the control.

6