Skip to content
T threat.cafe

Tag

#npm-audit

1 post

  1. · Priya Venkatraman · Intel commons after NVD · on threat.cafe

    Malicious packages are not vulnerabilities: why your CVE scanner can pass a package that is malware by design

    Malware gets a malware advisory, not a CVE, and lives in separate datasets. In our 15 October test, npm audit flagged three of four known-malicious versions; the fourth is listed in OSV but not in GitHub's database.