GHSA-679j-53p9-4q59 about advisory-database HOT 1 CLOSED

@achebrol thank you for proactively sharing your experience and concern.

On June 15th, we announced GitHub added malware advisories to the GitHub Advisory Database, though we do not send Dependabot alerts on them nor are the published to the repository here.

We found that the majority of those alerts in question (possibly including the one you raised) were for substitution attacks. During these types of incidents, an attacker would publish a package to the public registry with the same name as a dependency users rely on from a third party or private registry, with the hope a malicious version would be consumed. As Dependabot doesn’t look at project configuration to determine if the packages are coming from a third-party registry, it has been triggering a notification for packages with the same name from the public npm registry. To resolve this issue in the short term, we we paused all Dependabot notifications on malware advisories and will work to determine how to best notify customers of being the target of a substitution attack going forward.

If you are the owner of this package, it seems your package was the target of a substitution attack. However, it does not mean that there is an immediate action to be taken on your part as the malware has already been removed from the npm registry.

If you think this was created in error, you'll need to send in a reinstatement request. Here's a link to the npm policy and the form.

Alternatively, if someone else has been using the npm package name you can reach out to npm through the name dispute form.

Hope that helps and have a great day!

I'm going to close this Issue as there is no further action that we can take, but please reopen a new one if you have another ask!

from advisory-database.