Malicious package in @atlassianlabs/jql-editor-connect

[remie]

Long story short: this is a false positive.

The react-intl-next is actually overridden by a either a “resolutions” entry or by setting the version to npm:react-intl@^5.18.1 in all the Atlassian packages that have a dependency on this. The problem is that Snyk does not pick up on this as it only scans the actual dependencies and not the resolutions.

It would be better if Atlassian just updates the packages to use react-intl directly instead of redirecting it, but it seems that Atlassian has no incentive to do so.

There are other threads on this forum that mention this:

Critical security advisory for atlaskit dependency

Using the yarn dependency scanner ‘improved-yarn-audit’ is flagging a critical security vulnerability Malware in react-intl-next · GHSA-3h5j-8vhj-3cmf · GitHub Advisory Database · GitHub which originates from the dependency ‘react-intl-next’. This dependency is in my package.json according to the following guide Atlaskit by Atlassian as such: “react-intl-next”: “npm:react-intl@^5.18.1” Would appreciate if we can have a comment on this, thanks!

@atlassianlabs/jql-parser

There’s also seems to be a compromised package in dependency tree now: ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ critical │ Malware in react-intl-next │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ react-intl-next │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ No pa…