6 ms·

Anyone have a good solution to scan all code in our Github org for uses of the affected packages? Many of the methods we've tried have dead ended. Inability to

by aj_g 1y ago

Anyone have a good solution to scan all code in our Github org for uses of the affected packages? Many of the methods we've tried have dead ended. Inability to reliably search branches is quite annoying here.

ozim 1y ago
Have you tried Dependency Track from OWASP? Generate SBOM from each repo/projects and post it with API to DT and you have full overview. You have to hook it up so it is done automatically because of course stuff will always move.
TZubiri 1y ago
Any junior engineer should be able to solve this with grep in an afternoon.
- aj_g 1y ago
  For several thousand repos? Ensuring none of the 451 package versions have been installed on any branch in any repo? I don't think it's so simple.
  - deleted 1y ago
    [deleted]
  - TZubiri 1y ago
    aikido published a list of the affected vulns. You can probably get a list of the repos with a github API or something. Git clone with org admin user credentials (can be read only) so you have access to all the repos. run grep on all package.json files, search for all of the affected repos. No need to do any code regarding versions, just filter it down and manually process versions if needed. If you have any of these packages, no matter the versions, you should already be making efforts to migrating, kill the baby with the bathwater, cut off the arm before the gangrene spreads. At any rate you can check versions manually after you have filtered it down to something reasonable, part of automating is knowing when to stop.
deleted 1y ago
[deleted]
cube00 1y ago
If you have tens of thousands of repos with branches to match you'll be scanning all year. Proxy NPM with something like Artifactory which stops the bad package getting back in or ending up in any new builds. Follow it up with endpoint protection to weed the package out of the local checked out copies and .npm on the individual dev boxes.
ankit_mishra 1y ago
npm audit - will tell you if there's any packages with known vulnerabilities. https://docs.npmjs.com/cli/v11/commands/npm-audit https://docs.npmjs.com/cli/v11/commands/npm-audit I'd imagine it's considerably slower than search, but hopefully more reliable.

by aj_g 1y ago

ozim 1y ago

Have you tried Dependency Track from OWASP? Generate SBOM from each repo/projects and post it with API to DT and you have full overview. You have to hook it up so it is done automatically because of course stuff will always move.

TZubiri 1y ago

Any junior engineer should be able to solve this with grep in an afternoon.

aj_g 1y ago
For several thousand repos? Ensuring none of the 451 package versions have been installed on any branch in any repo? I don't think it's so simple.
- deleted 1y ago
  [deleted]
- TZubiri 1y ago
  aikido published a list of the affected vulns. You can probably get a list of the repos with a github API or something. Git clone with org admin user credentials (can be read only) so you have access to all the repos. run grep on all package.json files, search for all of the affected repos. No need to do any code regarding versions, just filter it down and manually process versions if needed. If you have any of these packages, no matter the versions, you should already be making efforts to migrating, kill the baby with the bathwater, cut off the arm before the gangrene spreads. At any rate you can check versions manually after you have filtered it down to something reasonable, part of automating is knowing when to stop.

deleted 1y ago

[deleted]

cube00 1y ago

If you have tens of thousands of repos with branches to match you'll be scanning all year. Proxy NPM with something like Artifactory which stops the bad package getting back in or ending up in any new builds. Follow it up with endpoint protection to weed the package out of the local checked out copies and .npm on the individual dev boxes.

ankit_mishra 1y ago

npm audit - will tell you if there's any packages with known vulnerabilities. https://docs.npmjs.com/cli/v11/commands/npm-audit https://docs.npmjs.com/cli/v11/commands/npm-audit I'd imagine it's considerably slower than search, but hopefully more reliable.