Overview
A change to our Hosted Data Services adds Fast-Track vulnerability data for npm components identified through package.json matching. This allows Lifecycle to report those findings without waiting for file-level evidence from Deep-Dive research. Firewall has always supported Fast-Track npm vulnerabilities, and now Lifecycle does too.
Lifecycle identifies npm dependencies from package manifests (package.json) even when the npm package archive (.tgz) isn’t present in the scanned project. Separately, Fast-Track vulnerability research identifies affected package coordinates, such as a package name and version, but does not identify vulnerable files inside the package. Now we connect the two: project manifests identify the package in the node_modules folder, plus Fast-Track research implicating the entire package (but not individual files inside that package).
Previous behavior
Fast-Track research identified an affected package by its coordinates, rather than by the files inside it. If a Lifecycle scan included a vulnerable npm .tgz archive, Lifecycle triggers a policy violation for Fast-Track data on that archive. That’s not how npm works though. Instead npm expands .tgz archives automatically, underneath a node_modules folder. Since Fast-Track research implicates the archive (.tgz), and the archive wasn’t in the scan, no policy violation occurred. This meant npm Fast-Track didn’t cause policy violations in Lifecycle.
This only applied to npm Fast-Track, not npm Deep Dive or any other Fast-Track.
That behavior differs from Firewall though. Firewall evaluates the actual npm archive (.tgz) as it’s downloaded, which matches Fast-Track research.
What changed
Deep Dive research implicates individual files (ex: .js) inside the archive. Lifecycle looks for those files, and, if it found vulnerable files, triggered a policy violation. Now Lifecycle identifies the npm package the same way, but if the research is Fast-Track it marks the entire package vulnerable and triggers the policy violation.
When the Sonatype Research team later completes Deep Dive research for that npm package, Deep Dive supersedes the Fast-Track research. So Deep Dive research on npm packages aren’t affected by this change and continue to work as before.
Firewall matching is also unaffected, and continues to work as before: it blocks packages whether they were Fast-Track or Deep Dive.
What to expect in scan results
- An npm package may now show a vulnerability while it’s in Fast-Track, even if no vulnerable files inside the .tgz archive have been identified yet.
- The finding is associated with the identified npm package and version. Fast-Track research may not yet confirm which child files in the archive are vulnerable, or whether every file in the archive’s affected.
- When Deep-Dive research completes, future scans may show more specific file-level findings. If that research determines the package or version isn’t affected, the earlier Fast-Track policy violation no longer appears.
- If users remove vulnerable files from the node_modules directory before the Lifecycle scan, no policy violations occur, as the vulnerable files have been removed. This feature is unchanged and continues to work as before.
- If a scan includes both an npm archive and its package contents, Lifecycle avoids reporting the same vulnerability twice for the same identified component.
Example
A project lists braces@3.0.3 in its npm dependency data. The scanned project includes the expanded package under node_modules/braces, but not braces-3.0.3.tgz.
With coordinate-based Fast-Track lookup, Lifecycle reports a Fast-Track vulnerability for the identified braces@3.0.3 component even though the .tgz archive is absent. If Deep-Dive research later identifies a vulnerable child file (ex: .js file), Lifecycle starts using that file-level evidence. Therefore Research updates may change the findings shown in future scans.
Frequently asked questions
Does Fast-Track mean that every file in the npm package is vulnerable?
No. Fast-Track identifies vulnerabilities at the package level and doesn’t include file-level analysis. Deep-Dive research provides that more specific file-level implications.
Why might the finding change after a later scan?
Vulnerability data can be refined as research progresses. A Fast-Track finding can be updated, narrowed, or removed after Deep Dive research determines which package versions or files are affected.
Does this change apply to every npm component in every scan?
The coordinate lookup applies to npm components Lifecycle identifies through package.json matching. The scan must successfully identify the package and its coordinates. Other existing identification and vulnerability matching continue to apply.
Does this change affect Firewall?
No, Firewall continues to support Fast-Track npm as before. The change addresses Lifecycle scans where the npm archive (.tgz) isn’t in the scan – which is typical of npm projects with a node_modules folder. Firewall already matches the archive during download and is unaffected by this change.