search

WICG / inert

Polyfill for the inert attribute and property.
Other
924 stars 81 forks source link

Malicious behavior detected in wicg-inert-3.1.2 package #198

Closed rupeshdeotale97 closed 2 months ago

rupeshdeotale97 commented 3 months ago

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running (user's machine or backend server). The following risks were identified: Malware dropper – this package contains a Trojan horse, allowing the unauthorized installation of other potentially malicious software.

Similar issue reported Over wicg-inert-3.1.2 package

jlczuk commented 2 months ago

Someone created PR-197 to address this.

Mend identified this package as being vulnerable because it refers to the old polyfill.io domain, which should no longer be used or referred to.

VikrantSangwan commented 2 months ago

Is this issue resolved I could see the pr (mentioned above) is still in the open state, Should we switch to the wicg-inert-3.1.1 package till this issue persists?

Eric-Arellano commented 2 months ago

Is this issue resolved

It will not be resolved until https://github.com/WICG/inert/pull/197 is merged and the package is re-released with 3.1.1.

bkardell commented 2 months ago

Merged, but just to note: It's a bit of the documentation that had some outdated advice though, not the package/code itself that was problematic.

CeceliaYu commented 2 months ago

the PR is merged, does that mean we can have 3.1.3 released shortly?

rupeshdeotale97 commented 2 months ago

@bkardell Any plan to release this change in 3.1.3

jlczuk commented 2 months ago

It would have been nice to remove references to polyfill.io from the README.md and karma.conf.js files too.

ForkInSpace commented 1 month ago

@bkardell Can this now be released on NPM ?