Cx8d6ac0b0-c224 @ Npm-flow-dev-tools-99.10.9

[gvocstr]

Vulnerable Package issue exists @ Npm-flow-dev-tools-99.10.9 in branch main

This package is using dependency confusion attack

About

Dependency Confusion is a technique discovered by @alex.birsan to hijack a privately used package by registering its name (if available) on a public registry with a higher version number. This may cause artifact servers and build tools to "confuse" and use the attacker's package.

For example, consider the following private package "my-company-utils" being hosted on a private artifact server:

In case an attacker targeting "my-company-utils" package, as long as it is not occupied by someone else on the official package manager, he's free to register it. If the attacker registers it and published with a very high version number such as "v99.99.99" most likely the automatic update logic and version comparisons functions will "confuse" and prefer using the attacker's package

As an addition step of mitigation, we recommend using our open-source tool as a CI step DustiLock

Namespace: gvocstr
Repository: ast-advanced-lab
Repository Url: https://github.com/gvocstr/ast-advanced-lab
CxAST-Project: gvocstr/ast-advanced-lab
CxAST platform scan: 2a525e57-0ef3-4b26-9f0e-6090ac931cbe
Branch: main
Application: ast-advanced-lab
Severity: HIGH
State: NOT_IGNORED
Status: NEW
CWE: Dependency Confusion

---

Addition Info