Reference to malicious package monorepo-symlink-test causing security scan to fail

[reify-thomas-smith]

The file test/resolver/multirepo/package.json is causing JFrog's vulnerability scanner to flag resolve because the name field is the name of a malicious package. This is definitely JFrog's fault and not resolve's, but if it's breaking for us, it's probably breaking for others.

[ljharb]

Indeed; I'm glad resolve is exposing the many "security" tools out there that are broken.

A scanner that even looks at package files that are only used in development of the package, and never referenced in production, will produce lots of false positives that distract from meaningful reports.

In particular, the package has private: true, and thus has no relationship to https://www.npmjs.com/package/monorepo-symlink-test, so I'd report this to JFrog with some urgency.

[oscarduignan]

@ljharb with this, could the test files be excluded from the package in npm if they don't need to be distributed? Assuming they are from looking into the package using unpkg https://unpkg.com/browse/[email protected]/test/

[ljharb]

Yep! They forever do, because npm explore foo && npm install && npm test should always work.

[oscarduignan]

cool, thank you @ljharb for the quick response 🙌