anchore / anchore/syft

Syft incorrectly identifies NuGet package "Newtonsoft.Json" as "Json.NET" with incorrect version

Open
#3,665 8 comments 1 reaction 0 assignees View on GitHub
bug needs-investigation
Dominant language
Go
Stars
9.6k
Forks
962
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What happened**:
When scanning the NuGet package `Newtonsoft.Json` version `12.0.3`, Syft incorrectly identifies the package as `Json.NET` instead of `Newtonsoft.Json`. Additionally, the version includes build metadata as `12.0.3.23909` instead of the correct `12.0.3`.

**What you expected to happen**:
- The package should be detected as `Newtonsoft.Json`, not `Json.NET`.
- The version should be reported as `12.0.3`.

**Steps to reproduce the issue**:
1. Download the `Newtonsoft.Json` NuGet package (version `12.0.3`) - https://www.nuget.org/packages/Newtonsoft.Json/12.0.3
2. Run Syft to scan the extracted package directory.
```bash
syft ./newtonsoft.json.12.0.3 --output json
```

**Anything else we need to know?**:
No

**Environment**:
- **Syft version**: `1.19.0`
- **OS**: `macOS Sequoia`

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with the NuGet package and the provided Syft JSON scan command. Trace how the package name and version are identified, then verify that the output reports Newtonsoft.Json at version 12.0.3 rather than Json.NET or 12.0.3.23909.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.