NodeSecure / NodeSecure/scanner
Malicious / Dangerous spec resolver to custom URL
Open
Nobody has claimed this yet.
hard
- Dominant language
- TypeScript
- Stars
- 40
- Forks
- 23
- Avg merge
- 23h 23m
- Merged PRs (30d)
- 2
Description
Custom spec resolver can be used to fake a package name (such as axios in the following example)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the behavior described for the custom spec resolver, using the attached example as the reference case. Trace how the resolver handles a custom URL and how the package name is reported; done means a resolver cannot make a different package appear under a chosen name, with regression coverage for the reported case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs, typescript
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100