chore: scope sample package name to prevent dependency confusion (H1 #2997377) - #18
Open
sebastian8x8 wants to merge 1 commit into
Open
chore: scope sample package name to prevent dependency confusion (H1 #2997377)#18sebastian8x8 wants to merge 1 commit into
sebastian8x8 wants to merge 1 commit into
Conversation
…#2997377) The unscoped 'jaas-jwt' name in this sample's package.json is a dependency-confusion vector — the public 'jaas-jwt' package on npm was claimed by an external party in February 2025 (HackerOne report #2997377). A developer who copies this sample and runs 'npm install jaas-jwt' resolves the public attacker-controlled package, not this directory's local code. Renames the sample to '@8x8/jaas-jwt-sample' (under the @8x8 npm scope, which 8x8/Jitsi owns and is structurally protected against drive-by registration) and adds 'private': true to block accidental publish from this directory. Surfaced by SOCmate's manifest_name_leak detector. No behavioural change to the sample itself; no consumers in the 8x8/Jitsi SBOM. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Renames this sample's
package.jsonname:field from the unscopedjaas-jwtto the scoped@8x8/jaas-jwt-sample, and adds"private": true. Single-file change injaas-jwt-samples/js/package.json; no behavioural impact on the sample itself.Why
The public npm package
jaas-jwtwas claimed by an external party in February 2025 — see HackerOne report #2997377 by @MuhammadWaseem3. While the report was closedInformative(the sample is not consumed as a dependency by other 8x8 projects), the manifest's barename:field is still a dependency-confusion vector:npm install jaas-jwt(or copies the sample wholesale into a project) resolves the public attacker-controlled package, not this directory's local code.8x8/Jitsi already owns the
@8x8scope on npm, which structurally prevents drive-by registration of@8x8/anything. Scoping the sample under@8x8makes the bare-name vector a no-op.What changed
jaas-jwt-samples/js/package.json:"name": "jaas-jwt"→"name": "@8x8/jaas-jwt-sample""private": true(belt-and-braces — blocks accidentalnpm publishfrom the sample dir; doesn't change attack surface but signals intent)Test plan
node src/index.jsstill runs fromjaas-jwt-samples/js/afternpm installjaas-jwtas a dependency (zero internal consumers per SOCmate SBOM, 2026-05-07)References
Follow-up
The squatted public
jaas-jwtpackage is still live on npm. Recommend filing a takedown viasecurity@npmjs.comciting H1 #2997377 + this PR.🤖 Generated with Claude Code