You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Vulnerable Package issue exists @ Npm-flow-dev-tools-99.10.9 in branch main
This package was manually inspected by a security researcher and flagged as malicious
About
Classifying malicious packages is an internal process, analysis is done at scale automatically via multiple engines. Once there's a risk suspicion, this is forwarded to a security researcher for a manual evaluation.
Attackers take advantage of the excessive trust in the open-source ecosystem and launch software supply chain attacks in the form of code packages.
The risk of having a package with a malicious payload is high. It's a common behavior for most of the malicious payloads to execute itself automatically upon installing or using the package.
While some dependency vulnerabilities have the privilege to be kept as known issue due to risk-management, same does not apply in the case of a malicious package, and it should be removed with the highest priority.
Vulnerable Package issue exists @ Npm-flow-dev-tools-99.10.9 in branch main
This package was manually inspected by a security researcher and flagged as malicious
About
Classifying malicious packages is an internal process, analysis is done at scale automatically via multiple engines. Once there's a risk suspicion, this is forwarded to a security researcher for a manual evaluation.
Attackers take advantage of the excessive trust in the open-source ecosystem and launch software supply chain attacks in the form of code packages.
The risk of having a package with a malicious payload is high. It's a common behavior for most of the malicious payloads to execute itself automatically upon installing or using the package.
While some dependency vulnerabilities have the privilege to be kept as known issue due to risk-management, same does not apply in the case of a malicious package, and it should be removed with the highest priority.
Namespace: gvocstr
Repository: ast-advanced-lab
Repository Url: https://github.com/gvocstr/ast-advanced-lab
CxAST-Project: gvocstr/ast-advanced-lab
CxAST platform scan: 2a525e57-0ef3-4b26-9f0e-6090ac931cbe
Branch: main
Application: ast-advanced-lab
Severity: HIGH
State: NOT_IGNORED
Status: NEW
CWE: Malicious Package
Addition Info
The text was updated successfully, but these errors were encountered: