Robustly get an object's own property keys (strings and symbols), including non-enumerables when possible.
by ljharbJavaScript
Last 12 weeks · 1 commit
4 of 6 standards met
When running a SCA scan on my project, it finds that own-keys is marked as malware. When I look in the version history in the scan software it also shows the following versions: 1.0.0, 1.0.1, 99.10.9, 99.10.13 Which makes it look like a dependency confusion attacked library even more. I also see that all the code for this library has been (re-)created in the past 2 days. Could you please clarify what is happening here?
Repository: ljharb/own-keys. Description: Robustly get an object's own property keys (strings and symbols), including non-enumerables when possible. Stars: 1, Forks: 1. Primary language: JavaScript. Languages: JavaScript (100%). License: MIT. Open PRs: 0, open issues: 1. Last activity: 1mo ago. Community health: 85%. Top contributors: ljharb.
The packages listed below contain Embedded Malicious Code. Upon installation, these packages execute scripts that gather system information and exfiltrate the data to the author's server. Weakness Sonatype CWE: 506 Might have big impact as it's used for example by via . As a temporary fix had to do override with v 1.23.7: