Update package.json by jadoonf · Pull Request #29 · jadoonf/sandbox

jadoonf · 2023-11-04T01:09:52Z

No description provided.

jadoonf · 2023-11-04T01:10:13Z

📊 Package size report `8%↑`

File	Before	After
`package.json`	`981 B`	^86%↑`1.8 kB`
Total _{(Includes all files)}	`11.0 kB`	^8%↑`11.9 kB`
Tarball size	`4.1 kB`	^7%↑`4.4 kB`

Unchanged files

File	Size
`.github/workflows/explain.yml`	`736 B`
`.github/workflows/lstn.yml`	`432 B`
`.github/workflows/package-size-report.yml`	`536 B`
`.github/workflows/scanners.yml`	`1.0 kB`
`.github/workflows/test/lstn-cli-workflow.yml`	`2.0 kB`
`.github/workflows/test/lstn-dynamic.yml`	`378 B`
`.github/workflows/test/lstn-policy.yml`	`334 B`
`index.js`	`28 B`
`README.md`	`3.4 kB`
`rules.yml`	`1.2 kB`

_{🤖 This report was automatically generated by pkg-size-action}

github-actions · 2023-11-04T01:12:32Z

listen.dev ∙ Security Report

critical 🚨 4	medium ⚠️ 5	low 🔷 1

🔍 The following behaviors have been detected in the dependency tree during installation

🚨 Critical severity

📑🔀	2 categories

📑 Metadata ∙ 1 package
- 📦 chokidar@3.5.3 ∙ 1 occurrence ∙ 1 kind of issue ∙ open 🔗
  - This package has inconsistent dependencies in the tarball's package.json ∙ 1 total occurrence
    
    Name Version Transitive Dependency Occurrences More
    
    chokidar 3.5.3 1 🔗
🔀 Typosquatting ∙ 3 packages
- 📦 jq@1.7.2 ∙ 1 occurrence ∙ 1 kind of issue ∙ open 🔗
  - The name of this package closely resembles other package names ("q") which are popular on NPM: it might be a typosquatting attempt ∙ 1 total occurrence
    
    Name Version Transitive Dependency Occurrences More
    
    jq 1.7.2 1 🔗
- 📦 ink@3.2.0 ∙ 1 occurrence ∙ 1 kind of issue ∙ open 🔗
  - The name of this package closely resembles other package names ("ini") which are popular on NPM: it might be a typosquatting attempt ∙ 1 total occurrence
    
    Name Version Transitive Dependency Occurrences More
    
    ink 3.2.0 1 🔗
- 📦 findit@2.0.0 ∙ 1 occurrence ∙ 1 kind of issue ∙ open 🔗
  - The name of this package closely resembles other package names ("findit2") which are popular on NPM: it might be a typosquatting attempt ∙ 1 total occurrence
    
    Name Version Transitive Dependency Occurrences More
    
    findit 2.0.0 1 🔗

⚠️

Medium severity

📡🔎	2 categories

📡 Dynamic instrumentation ∙ 1 package
- 📦 jq@1.7.2 ∙ 4 occurrences ∙ 2 kind of issues ∙ open 🔗
  - npm install spawned a process ∙ 1 total occurrence
    
    Name Version Transitive Dependency Occurrences More
    
    contextify 0.1.15 ✔️ 1 🔗
  - unexpected outbound connection destination ∙ 3 total occurrences
    
    Name Version Transitive Dependency Occurrences More
    
    contextify 0.1.15 ✔️ 3 🔗
🔎 Static analysis ∙ 1 package
- 📦 ink@3.2.0 ∙ 1 occurrence ∙ 1 kind of issue ∙ open 🔗
  - install script detected in package.json ∙ 1 total occurrence
    
    Name Version Transitive Dependency Occurrences More
    
    ink 3.2.0 1 🔗

🔷 Low severity

📑	1 category

📑 Metadata ∙ 1 package
- 📦 source-map-support@0.5.21 ∙ 1 occurrence ∙ 1 kind of issue ∙ open 🔗
  - This package version is 0.X.Y: the semver spec mandates those versions for initial development meaning that anything may change at any time and the public API of this package should not be considered stable. ∙ 1 total occurrence
    
    Name Version Transitive Dependency Occurrences More
    
    source-map-support 0.5.21 1 🔗

### 🚩 Some problems have been encountered

🔗 Package not analysed yet ∙ 30 occurrences ∙ Package not analysed yet

See docs 🔗

Powered by listen.dev

jadoonf · 2023-11-21T04:41:19Z

🚀 Pull Request Security Summary

Critical 🚨: 2 issues | Medium ⚠️: 4 issues | Low 🔷: 1 issue

Issues Impacting Your Code

🚨 Critical Issues Affecting Used Code (2)

📦 micromatch@4.0.5: Security vulnerability found. View Details | Fix It
📦 license-checker@25.0.1: License inconsistency detected. View Details | Resolve It

⚠️ Medium Issues Affecting Unused Code (4)

📦 keytar@7.9.0: Outbound connection attempt observed. View Details | Investigate

🔷 Low Severity Issues (1)

📦 webpack@5.89.0: Package size larger than usual. View Details | Optimize

For a complete security report and to adjust your alert settings, visit listen.dev.

jadoonf · 2023-11-21T04:41:30Z

🔐 Security Compliance Report

Critical 🚨: 2 issues | Medium ⚠️: 4 issues | Low 🔷: 1 issue

Comprehensive Risk Assessment

🚨 Critical Risk Profile (2 Issues)

Static Analysis Findings
- 📦 micromatch@4.0.5: Possible credential leakage detected. View Risk Details | Policy Review
- 📦 license-checker@25.0.1: Non-compliant license usage. View Risk Details | Policy Review

⚠️ Medium External Dependency Risks (4 Issues)

Dynamic Behavior Analysis
- 📦 keytar@7.9.0: Detected abnormal behavior in network activity. View Risk Details | Behavior Analysis

🔷 Low Policy Deviations (1 Issue)

Dependency Review
- 📦 webpack@5.89.0: Deviation from size standards. View Risk Details | Compliance Check

For full risk profiles and behavior analysis, access the Security Dashboard.

jadoonf · 2023-11-21T04:41:58Z

Security Alert Summary

Critical 🚨: 5 | Medium ⚠️: 28 | Low 🔷: 2

Impact on Your Codebase

Critical: Issues that directly affect your application’s security and functionality.
Medium: May indirectly affect your application, possibly in production.
Low: Minor issues, but worth reviewing for future code quality.

Take Action

🚨 Critical Issues - Immediate Action Required (5)

📦 micromatch@4.0.5: GitHub dependency detected. Fix Now
📦 ws@8.14.2: Potential typosquatting attempt. Resolve Now

Please review the rest in the detailed report.

⚠️ Medium and 🔷 Low Issues - Review at Your Earliest Convenience

📦 keytar@7.9.0: Possible outbound connection detected. Investigate

Complete issue list available in the full security report.

For a detailed breakdown and more actions, visit your Security Dashboard.

jadoonf · 2023-11-21T04:42:04Z

Comprehensive Security Report

Critical 🚨: 5 | Medium ⚠️: 28 | Low 🔷: 2

Executive Summary

Critical: Immediate threat to security or compliance.
Medium: Potential risks that may escalate if not addressed.
Low: Issues that do not pose immediate risk but require attention to maintain code health.

Risk Assessment and Policy Compliance

🚨 Critical Risk Profile - Requires Urgent Attention (5)

📦 micromatch@4.0.5: Detected GitHub dependency. Review Policy
📦 ws@8.14.2: Suspected typosquatting. Conduct Behavioral Analysis

Further details on risk sources and recommended actions in the full report.

⚠️ Medium Risk and 🔷 Low Risk - Schedule for Review

📦 keytar@7.9.0: Observed abnormal behavior. Audit External Dependencies

Access in-depth analysis and policy guidelines in the security dashboard.

Access the Full Security Report for detailed insights and policy management options.

jadoonf · 2023-11-21T04:45:10Z

listen.dev ∙ Enhanced Security Report

critical 🚨 5	medium ⚠️ 28	low 🔷 2

🔍 Enhanced Analysis of Dependency Behaviors During Installation

🚨 Critical severity - Detected Issues and Actionable Insights

🔎🔀	2 categories

🔎 Static Analysis ∙ 2 packages
- 📦 micromatch@4.0.5
  - Issue: GitHub dependency in package.json.
  - Action: Review dependency source for potential risks.
  - Details: 🔗
- 📦 license-checker@25.0.1
  - Issue: GitHub dependency in package.json.
  - Action: Verify license compliance.
  - Details: 🔗
🔀 Typosquatting Concerns ∙ 3 packages
- 📦 ws@8.14.2
  - Issue: Name resembles "ms", "qs" (possible typosquatting).
  - Action: Confirm correct package usage.
  - Details: 🔗
- 📦 pkg@5.8.1
  - Issue: Name resembles "pg", "pug" (possible typosquatting).
  - Action: Verify package integrity.
  - Details: 🔗
- 📦 @types/ws@8.5.9
  - Issue: Name resembles "@types/qs" (possible typosquatting).
  - Action: Check for correct package references.
  - Details: 🔗

⚠️

Medium Severity - Observed Behaviors and Recommendations

📡🔎	2 categories

📡 Dynamic Instrumentation ∙ 2 packages
- 📦 keytar@7.9.0
  - Issues: Process spawn during install, unexpected outbound connections.
  - Action: Review network activity for security implications.
  - Details: 🔗
- 📦 @types/keytar@4.4.2
  - Issues: Process spawn during install, unexpected outbound connections.
  - Action: Monitor for abnormal behavior.
  - Details: 🔗
🔎 Static Analysis ∙ Extended Insights for 14 packages

Detailed analysis and actions for 14 packages with install script concerns.

🔷 Low Severity - Minor Alerts and Observations

📑	1 category

jadoonf · 2023-11-21T04:45:32Z

Comprehensive Security Compliance Report

Critical 🚨: 5 | Medium ⚠️: 28 | Low 🔷: 2

Critical Security Risks

🚨 Critical Security Risks (5)

📦 micromatch@4.0.5
- Issue: GitHub dependency found in package.json.
- Risk: Introduces risk of pulling unsecured updates directly from GitHub.
- Action: Evaluate the necessity of this direct dependency or switch to a version hosted on a secure package registry.
📦 ws@8.14.2
- Issue: Package name closely resembles popular NPM packages.
- Risk: High risk of incorporating a malicious package due to name confusion (typosquatting).
- Action: Verify the authenticity of the package and replace with a verified package if necessary.

Medium Security Risks

⚠️ Medium Security Risks (28)

📦 keytar@7.9.0
- Issue: Multiple unexpected outbound connections during installation.
- Risk: Potential indication of data exfiltration or command and control communication.
- Action: Investigate the connections to ensure they are legitimate and necessary for the package's functionality.

Low Security Risks

🔷 Low Security Risks (2)

📦 webpack@5.89.0
- Issue: Discrepancy in devDependencies within the package's package.json.
- Risk: Could lead to build inconsistencies and potential for missing or outdated development dependencies.
- Action: Verify and update the devDependencies to match the stable and secure versions needed.

Review the provided details to guide your security team's actions. Ensure all findings are investigated and resolved in line with your company's security policies.

jadoonf · 2023-11-21T04:45:38Z

Security Alert for Your Review

Critical 🚨: 5 | Medium ⚠️: 28 | Low 🔷: 2

Critical Issues

🚨 Critical Issues Affecting Your Code (5)

📦 micromatch@4.0.5: Detected GitHub dependency.
Risk: Can introduce unvetted code leading to potential vulnerabilities.
Action: Verify the repository for the latest secure version or consider a safer alternative.
📦 ws@8.14.2: Similar name to popular NPM packages (ms, qs).
Risk: Potential typosquatting could lead to malicious code execution.
Action: Confirm the integrity of the package, or replace it with the correct, intended package.

Medium Severity

⚠️ Medium Severity Issues (28)

📦 keytar@7.9.0: Unexpected outbound connections during installation.
Risk: Could indicate a security risk such as data leakage or unauthorized access.
Action: Review the package's network activity, check for open issues regarding this behavior, and assess the need for this package in your project.

Low Severity

🔷 Low Severity Issues (2)

📦 webpack@5.89.0: Inconsistent devDependencies.
Risk: Inconsistencies can lead to unexpected behavior during development or build processes.
Action: Align the devDependencies in your package.json with the project's requirements, and ensure all developers are using the same versions.

Each issue should be reviewed and addressed according to its impact on your project. Please ensure to follow your organization's guidelines for vulnerability resolution.

jadoonf · 2023-11-21T04:49:55Z

listen.dev ∙ Enhanced Security Report

critical 🚨 5	medium ⚠️ 28	low 🔷 2

🔍 Enhanced Analysis of Dependency Behaviors During Installation

🚨 Critical severity - Detected Issues and Actionable Insights

🔎🔀	2 categories

🔎 Static Analysis ∙ 2 packages
- 📦 micromatch@4.0.5
  - Issue: GitHub dependency in package.json.
  - Action: Review dependency source for potential risks.
  - Details: 🔗
- 📦 license-checker@25.0.1
  - Issue: GitHub dependency in package.json.
  - Action: Verify license compliance.
  - Details: 🔗
🔀 Typosquatting Concerns ∙ 3 packages
- 📦 ws@8.14.2
  - Issue: Name resembles "ms", "qs" (possible typosquatting).
  - Action: Confirm correct package usage.
  - Details: 🔗
- 📦 pkg@5.8.1
  - Issue: Name resembles "pg", "pug" (possible typosquatting).
  - Action: Verify package integrity.
  - Details: 🔗
- 📦 @types/ws@8.5.9
  - Issue: Name resembles "@types/qs" (possible typosquatting).
  - Action: Check for correct package references.
  - Details: 🔗

⚠️

Medium Severity - Observed Behaviors and Recommendations

📡🔎	2 categories

📡 Dynamic Instrumentation ∙ 2 packages
- 📦 keytar@7.9.0
  - Issues: Process spawn during install, unexpected outbound connections.
  - Action: Review network activity for security implications.
  - Details: 🔗
- 📦 @types/keytar@4.4.2
  - Issues: Process spawn during install, unexpected outbound connections.
  - Action: Monitor for abnormal behavior.
  - Details: 🔗
🔎 Static Analysis ∙ Extended Insights for 14 packages

Detailed analysis and actions for 14 packages with install script concerns.

🔷 Low Severity - Minor Alerts and Observations

📑	1 category

📑 Metadata Considerations ∙ 2 packages
- 📦 webpack@5.89.0
  - Issue: Inconsistent devDependencies in tarball's package.json.
  - Action: Verify dependency accuracy.
  - Details: 🔗
- 📦 source-map-support@0.5.21
  - Issue: Package version indicates initial development phase.
  - Action: Assess stability and API changes.
  - Details: 🔗

Powered by listen.dev

Update package.json

9877936

Update package.json

87a747f

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update package.json - #29

Update package.json#29
jadoonf wants to merge 2 commits into
mainfrom
mix-deps-test

jadoonf commented Nov 4, 2023

Uh oh!

jadoonf commented Nov 4, 2023 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 4, 2023

Uh oh!

jadoonf commented Nov 21, 2023

Uh oh!

jadoonf commented Nov 21, 2023

Uh oh!

jadoonf commented Nov 21, 2023

Uh oh!

jadoonf commented Nov 21, 2023

Uh oh!

jadoonf commented Nov 21, 2023

Uh oh!

jadoonf commented Nov 21, 2023

Uh oh!

jadoonf commented Nov 21, 2023

Uh oh!

jadoonf commented Nov 21, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jadoonf commented Nov 4, 2023

Uh oh!

jadoonf commented Nov 4, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Package size report 8%↑

Uh oh!

github-actions Bot commented Nov 4, 2023

listen.dev ∙ Security Report

🔍 The following behaviors have been detected in the dependency tree during installation

Uh oh!

jadoonf commented Nov 21, 2023

🚀 Pull Request Security Summary

Issues Impacting Your Code

Uh oh!

jadoonf commented Nov 21, 2023

🔐 Security Compliance Report

Comprehensive Risk Assessment

Uh oh!

jadoonf commented Nov 21, 2023

Security Alert Summary

Impact on Your Codebase

Take Action

Uh oh!

jadoonf commented Nov 21, 2023

Comprehensive Security Report

Executive Summary

Risk Assessment and Policy Compliance

Uh oh!

jadoonf commented Nov 21, 2023

listen.dev ∙ Enhanced Security Report

🔍 Enhanced Analysis of Dependency Behaviors During Installation

Uh oh!

jadoonf commented Nov 21, 2023

Comprehensive Security Compliance Report

Critical Security Risks

Medium Security Risks

Low Security Risks

Uh oh!

jadoonf commented Nov 21, 2023

Security Alert for Your Review

Critical Issues

Medium Severity

Low Severity

Uh oh!

jadoonf commented Nov 21, 2023

listen.dev ∙ Enhanced Security Report

🔍 Enhanced Analysis of Dependency Behaviors During Installation

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jadoonf commented Nov 4, 2023 •

edited

Loading

📊 Package size report `8%↑`