Zach Leatherman @zachleat

Recent searches

Search options

Only available when logged in.

**Zach Leatherman** @zachleat · Mar 24 *

Why does socket.dev report that the latest version of next.js has a malware dependency? https://socket.dev/npm/package/next/alerts/15.2.3?tab=dependencies

“Malicious code in gen-mapping (npm) Any computer that has this package installed or running should be considered fully compromised.”

Update: looks like this is a pretty big flaw in the vulnerability scanner — not in next (check the replies for more info)

Screenshot of socket.dev report has the following alert:

Known malware: This package is malware. We have asked the package registry to remove it. Found 1 instance in 1 package

**Zach Leatherman** @zachleat · Mar 24

Mar 24

Zach Leatherman @zachleat

Update: thanks to @chrisw_b for hunting this down: looks like a huge flaw in the vulnerability scanner being used by these tools (it ignores namespaces on package names!)

More info:

https://github.com/jridgewell/gen-mapping/issues/12
https://github.com/anchore/grype/issues/1701

Hey @jridgewell, our build broke recently because of github is flagging your project as malware. I hope this is a false positive :) GHSA-8rmg-jf7p-4p22 Could you dispute it? There are apparently ot...

GitHubgen-mapping flagged as malware · Issue #12 · jridgewell/gen-mappingBy ataraxus

Zach Leatherman @zachleat@zachleat.com

Pam from the office (is a vulnerability scanner) and is looking at two pictures: one of `@name/name` and one of `name`: She says they are the same picture

Mar 24, 2025, 02:23 PM··Web

1boost·14favorites

**Zach Leatherman** @zachleat · Mar 24

Mar 24

Zach Leatherman @zachleat

it’s hard not to be jaded when facial recognition is being used in criminal investigations while our industry is having trouble accurately testing whether two strings are equal