jethac opened a new issue, #42982: URL: https://github.com/apache/superset/issues/42982
### Problem **This is not a vulnerability in Superset.** No malicious code is fetched or executed. Filing it here rather than to security@ because the exposure is a name collision with a third-party package that is already public on npm. `superset-frontend/package.json` declares local plugins by bare name via `file:` dependencies: ```json "eslint-plugin-i18n-strings": "file:eslint-rules/eslint-plugin-i18n-strings" ``` A package of the same name exists on the public npm registry and is flagged as malware. The `file:` specifier resolves to the in-repo directory, so the registry package is never fetched — but two practical costs follow: 1. `npm audit` reports a permanent phantom **critical** against the repository, which trains contributors to ignore audit output. 2. It is a live typosquat hazard. Anyone installing without the workspace context, or any tool that resolves the bare name, gets the flagged package instead. ### Proposed change Namespace the local plugins under the org scope — `@superset-ui/eslint-plugin-i18n-strings` — so no bare public name can shadow them, and update the `oxlint.json` and ESLint config references. The sibling `eslint-plugin-icons` has the same shape. Verified against `master` at `3539c41dab`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
