gen-mapping is listed as malware

[markcrivera]

A vulnerability scanner is flagging my project due to this:

GHSA-8rmg-jf7p-4p22

I believe this needs to be updated.

[KateCatlin]

@markcrivera thank you for proactively sharing your experience and concern.

On June 15th, we announced GitHub added malware advisories to the GitHub Advisory Database, though we do not send Dependabot alerts on them.

We found that the majority of those alerts in question (possibly including the one you raised) were for substitution attacks. During these types of incidents, an attacker would publish a package to the public registry with the same name as a dependency users rely on from a third party or private registry, with the hope a malicious version would be consumed. As Dependabot doesn’t look at project configuration to determine if the packages are coming from a third-party registry, it has been triggering a notification for packages with the same name from the public npm registry. To resolve this issue in the short term, we we paused all Dependabot notifications on malware advisories and will work to determine how to best notify customers of being the target of a substitution attack going forward.

I'm sorry you're still getting flagged through your external vulnerability scanner!

If you are the owner of this package, it seems your package was the target of a substitution attack. However, it does not mean that there is an immediate action to be taken on your part as the malware has already been removed from the npm registry. If you think this was created in error, you'll need to send in a reinstatement request. Here's a link to the npm policy and the form. Alternatively, if someone else has been using the npm package name you can reach out to npm through the name dispute form.

If you are not the owner of this package and still think the advisory should be removed, you'd have to go through the npm team to get it resolved: https://www.npmjs.com/support

Hope that helps and have a great day!

I'm going to close this Issue as there is no further action that we can take, but please reopen a new one if you have another ask!

[ataraxus]

Still flagged and broke also our build too. I crated an issue jridgewell/gen-mapping#12 at the original project. If this would be true it will crate a lot of trouble since its a dependency of babel

[ataraxus]

The attribution is correct, it is a typesquatting attempt which acutally confuses grype, which wrongly attributes it to @jridgewell/gen-mapping. See: anchore/grype#1886