René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Cxfd197ca1-b64b @ Npm-momnet-2.29.1","articleBody":"**Vulnerable Package** issue exists @ **Npm\\-momnet\\-2\\.29\\.1** in branch **main**\r\n\r\nThis package was manually inspected by a security researcher and flagged as malicious\n### About\n\nClassifying malicious packages is an internal process, analysis is done at scale automatically via multiple engines. Once there's a risk suspicion, this is forwarded to a security researcher for a manual evaluation.\n\nAttackers take advantage of the excessive trust in the open-source ecosystem and launch software supply chain attacks in the form of code packages.   \n\nThe risk of having a package with a malicious payload is high. It's a common behavior for most of the malicious payloads to execute itself automatically upon installing or using the package. \n\n![infographic](https://checkmarx-scs-cdn.s3.amazonaws.com/sca/infographics/malicious-package.png)\n\nWhile some dependency vulnerabilities have the privilege to be kept as known issue due to risk-management, same does not apply in the case of a malicious package, and it should be removed with the highest priority.\r\n\r\n**Namespace:** James-AST\r\n**Repository:** msft\r\n**Repository Url:** https://github.com/James-AST/msft\r\n**CxAST\\-Project:** James-AST/msft\r\n**CxAST platform scan:** [d217bf9e\\-499c\\-4ae8\\-a115\\-08b6cd62b182](https://ast.checkmarx.net/projects/fada48c7-0c49-472a-994a-763d8a847895/scans?id=d217bf9e-499c-4ae8-a115-08b6cd62b182\u0026branch=main)\r\n**Branch:** main\r\n**Application:** msft\r\n**Severity:** HIGH\r\n**State:** NOT_IGNORED\r\n**Status:** RECURRENT\r\n**CWE:** Malicious Package\r\n\r\n\r\n----\r\n**Addition Info**\r\n","author":{"url":"https://github.com/jbrotsos","@type":"Person","name":"jbrotsos"},"datePublished":"2022-06-16T16:40:05.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/52/msft/issues/52"}