gen-mapping flagged as malware

[ataraxus]

Hey @jridgewell, our build broke recently because of github is flagging your project as malware. I hope this is a false positive :)

GHSA-8rmg-jf7p-4p22

Could you dispute it?

There are apparently others having the same issue:

github/advisory-database#3280

Assuming you are not distributing malware on purpose ;)

[jridgewell]

gen-mapping is not the package that I release. Looks like someone tried to type-squat the official package @jridgewell/gen-mapping. I'd trust the GH advisory message, you should treat your systems as compromised.

[ataraxus]

Thanks for clarification. Then its grype not correctly parsing the package-lock.json. i have a look on this.

[ataraxus]

I could reproduce this with the current version of grype, which apparently gets confused and reported it there (anchore/grype#1886). Sorry for the confusion.