-
Notifications
You must be signed in to change notification settings - Fork 19
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
NPM packages with namespaces from ReversingLabs don't have namespace in name. #555
Comments
I will pause the reversing labs ingestion to ensure no new data is ingested until we have confirmed a fix. Errant reports can either be corrected (moved to the correct location) in the case that the report doesn't yet exist, or withdrawn if the do. |
This is to mitigate #555 Signed-off-by: Caleb Brown <calebbrown@google.com>
Signed-off-by: Caleb Brown <calebbrown@google.com>
* Add ability to pause/disable sources at config. This is to mitigate #555 Signed-off-by: Caleb Brown <calebbrown@google.com> * Pause reversing labs while #555 is resolved. Signed-off-by: Caleb Brown <calebbrown@google.com> * Disable gocognit linter for now. Signed-off-by: Caleb Brown <calebbrown@google.com> --------- Signed-off-by: Caleb Brown <calebbrown@google.com>
This helps prevent and detect cases like #555. Signed-off-by: Caleb Brown <calebbrown@google.com>
fwiw it looks like https://osv.dev/vulnerability/MAL-2024-3239 is also a result of this which is a version that actually overlaps with a valid used version - it would be good to know how we can get these invalid advisories cleared since they're being flagged by the scanner. I also wonder if osv.dev should be doing some validation around the PURLs as it sounds like they're invalid so maybe the |
This fixes part of #555. Signed-off-by: Caleb Brown <calebbrown@google.com>
Remove source data so the broken reports can be ingested again. Signed-off-by: Caleb Brown <calebbrown@google.com>
* Repair reports that incorrectly merged with existing reports. Signed-off-by: Caleb Brown <calebbrown@google.com> * Withdraw npm packages "react" and "shared" caused by #555. Remove source data so the broken reports can be ingested again. Signed-off-by: Caleb Brown <calebbrown@google.com> * Repair reports that have multiple RL sources. Signed-off-by: Caleb Brown <calebbrown@google.com> * Repair novel single source reports. Signed-off-by: Caleb Brown <calebbrown@google.com> * Withdraw reports placed in the wrong location when another already exists. Signed-off-by: Caleb Brown <calebbrown@google.com> * Withdraw reports placed in the wrong location when another already exists. Signed-off-by: Caleb Brown <calebbrown@google.com> * Clean up two top level packages from the Reversing Labs data. Signed-off-by: Caleb Brown <calebbrown@google.com> * Clean up overlapping sources from Reversing Labs Signed-off-by: Caleb Brown <calebbrown@google.com> * Update the names to match the purls. Signed-off-by: Caleb Brown <calebbrown@google.com> --------- Signed-off-by: Caleb Brown <calebbrown@google.com>
False positives and data problems have been resolved. Some Reversing Labs reports need to be re-added, but that is less urgent. |
This helps prevent and detect cases like #555. Signed-off-by: Caleb Brown <calebbrown@google.com>
Hey, to clarify for anyone affected or following this issue, I work for ReversingLabs and am 'in charge' for exposing our advisories, and as such responsible for this mess :) I'd like to apologize for any alarms this may have triggered, it was a dumb oversight we should have caught, and I take the full blame for it. Our security researchers work hard and do a great job at finding malicious packages across multiple ecosystems, I hate to see their work besmirched by what is essentially a conversion error by my side; we'll make sure this doesn't happen again. It's not the best first impression but we are very excited by this collaboration, and hope to continually contribute to the OSSF going forward. |
This complets the data restoration for #555. Signed-off-by: Caleb Brown <calebbrown@google.com>
This complets the data restoration for #555. Signed-off-by: Caleb Brown <calebbrown@google.com>
The data fixing is now complete. I will close this issue once I have un-paused the reversing-labs source in the config. |
Hi @calebbrown . It looks like some packages are missing from the "withdrawn" list, such as NPM |
@lujunsan I have fixed the summaries as well. Those reports are now clearly for Is your issue that the OSV files now point to different packages, despite previously pointing at |
Hi @calebbrown . I was under the impression that these packages that were at some point marked as malicious but later fixed should also be added to the "withdrawn" list, same as what was done for Is this not accurate? Like you say, the reports for those packages are correct now (and thanks for regenerating the summaries!), nothing to change there; I was just expecting to also find those fixed packages with entries in the withdrawn list, but I may have misunderstood the process. |
Hi @lujunsan, the problem that was corrected was that the Since it was ambiguous which package was being reported as malicious, for packages which did not have an existing report, it was decided to fix the ambiguity and move the report into the correct path, rather than withdrawing the report. This means the As far as I'm aware (and I plan to confirm this with the OSV team) OSV reports are designed to be mutable so they can be extended and corrected as needed. This should mean that this type of change should be okay to make. |
As at the time of reporting the number is 232 in NPM.
For example
@zettle-bo/react
is listed asreact
.The text was updated successfully, but these errors were encountered: