search

ossf / malicious-packages

A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.
Apache License 2.0
205 stars 19 forks source link

fsevents <= 1.2.10 , is not malicious anymore #527

Open mustafanaa opened 1 month ago

mustafanaa commented 1 month ago

It was confirmed that AWS had agreed to take ownership and block all access to the S3 bucket and as such it has mitigated the straightforward attack vector - this can be further confirmed by attempting to access the bucket which returns a AllAccessDisabled or NoSuchBucket error , therefor I do not think that this packages are malicious anymore.

calebbrown commented 1 week ago

Hi mustafanaa,

Thank you for posting that context. It is nice to know that AWS has done more to block this attack vector from occurring again too.

However, despite this, I do not think the package versions should be marked as not malicious anymore.

  1. anyone who installed the affected versions while the compromised binaries where available should know that they were very likely compromised
  2. at some future date AWS may change their behavior and allow the package to be compromised again

I hope that helps.