News for hackers. Stuff that matters.

A comment on GitHub Advisory Database now powers NPM audit.

Re:GitHub Advisory Database now powers NPM audit by valkum on Thursday October 07, 2021 @02:10PM (#28790065)
looking at the latest illissued lodash CVE they seem to deliver CVEs that are withdrawn in GH Advisory Database
[ Parent | on HN ]
Re:GitHub Advisory Database now powers NPM audit by ethomson on Thursday October 07, 2021 @03:43PM (#28791152)
Product Manager for npm here. That was correct. As part of our integration, we were not excluding withdrawn advisories. We've since corrected this. Apologies!
[ Parent | on HN ]