Unleash-server image NexusIQ Threats

[NickFlokstra]

Hello!

Our NexusIQ scan found a lot of threats in the unleash-server image. Is a fix on the agenda?

Kind regards,

Nick

[gastonfournier]

Hi @NickFlokstra, thanks for the report, we're going to look at them

[NickFlokstra]

Thank you for the quick reply and the axios fix. However our scan still finds the es5-ext : 0.10.64 vulnerability, that puts it in quarantine.

[gastonfournier]

Looking at https://www.npmjs.com/package/es5-ext there's no recent release and according to this: https://security.snyk.io/package/npm/es5-ext there's no active vulnerability in this revision, so this looks like a bad report.

[NickFlokstra]

If I see it correctly, the security-malicious is still in there: medikoo/es5-ext#116 and https://checkmarx.com/blog/new-protestware-found-lurking-in-highly-popular-npm-package/. Maybe it does not show up since people are divided how they feel about it?

[gastonfournier]

This (medikoo/es5-ext#116) appears related to the 2022 "protestware" controversy, rather than a traditional malware or package-compromise incident.

We are not seeing evidence of credential theft, remote code execution, data exfiltration, or similar malicious behavior associated with this dependency. The reports appear to stem primarily from supply-chain/reputation classification by some security vendors and scanners.

In our case, es5-ext is also a deep transitive dependency inherited through older utility packages (memoizee, es6-*, etc.), rather than something directly depended on or used intentionally by Unleash itself.

At the moment, we do not have plans for a dedicated remediation specifically targeting this dependency, as there is no upstream security patch or clear exploit scenario we can address. Replacing the affected dependency chain would likely require broader ecosystem changes upstream.

[NickFlokstra]

Okay. Thank you for the clear answer and fast responses! I will discus it internally if we will waiver this threat.