deps: match dependencies against the bundled IOC database, not just the (empty) feed - #317
Open
Ar9av wants to merge 1 commit into
Open
deps: match dependencies against the bundled IOC database, not just the (empty) feed#317Ar9av wants to merge 1 commit into
Ar9av wants to merge 1 commit into
Conversation
…he feed
`prismor deps` correlated manifests only against the signed advisory feed's
`dependency_vulnerability` entries — of which the shipped feed
(advisories/immunity-feed.json) has ZERO (217 advisories, 0 dependency ones).
So a manifest pinning a known-malicious package Prismor itself curates in
supplychain/ioc.py — mistralai==2.4.6, guardrails-ai==0.10.1,
@mistralai/mistralai in the mini-Shai-Hulud range — was reported clean (only a
missing-lockfile nag). The dependency checker's core job silently did nothing.
Fix: scan_workspace now also consults the bundled supplychain.ioc database via
a new check_against_ioc(), independent of the signed feed (no signing needed,
always present). Results are shaped like feed matches so all rendering and
exit-code logic is unchanged; deduped by (id, name) against feed matches.
An exact pip pin ("==2.4.6") is normalized to its concrete version so it hits
the CRITICAL exact-range verdict rather than degrading to a name-only HIGH;
floating specifiers (>=, ~=, ^) still fall back to the name-only verdict.
On the repro manifests: 0 -> 3 CRITICAL findings. Safe adjacent version
(mistralai==2.4.5) stays clean. 3 regression tests added to test_deps_semver.py
(empty-feed IOC match, no-false-positive on safe version, npm range).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
prismor deps— whose entire job is "check workspace dependencies against the threat feed" — never matched anything, because the shipped signed feed (advisories/immunity-feed.json) contains 217 advisories but 0 of typedependency_vulnerability. Meanwhile Prismor curates a rich IOC database insupplychain/ioc.py(the TanStack / mini-Shai-Hulud / AntV supply-chain attacks). The two were never connected.So a manifest pinning a known-malicious package Prismor itself documents was reported clean:
Before —
requirements.txtwithmistralai==2.4.6+guardrails-ai==0.10.1(both curated IOCs),package.jsonwith@mistralai/mistralai@2.2.4→ only a missing-lockfile nag:After — the same manifests, all three flagged CRITICAL with attack attribution:
Fix
scan_workspace()now also consults the bundledsupplychain.iocvia a newcheck_against_ioc(), independent of the signed feed (no signing key needed, always present). Matches are shaped exactly like feed matches, so all rendering, JSON output, and the exit-code=1 behavior are unchanged; deduped by(advisory_id, dep name).An exact pip pin (
==2.4.6) is normalized to its concrete version so it hits the CRITICAL exact-range verdict instead of degrading to a name-only HIGH. Floating specifiers (>=,~=,^) still fall back to name-only.Testing
mistralai==2.4.5stays clean (no false positive).tests/test_deps_semver.py(empty-feed IOC match; no-FP on safe version; npm range). Full file: 11 passed.