Thanks @sebastien_picavet for this idea. I ended up with two js scripts to get the whole advisory database from GitHub (only 100 entries per request) and check against our nexus server.
fsevents < 1.2.11 was the malicous package. All other hits look like false positive (all created on github on Jun 20, 2022 and all with version >= 0 and no patched version)
Thanks @sebastien_picavet - worked out for us as well. For small findings it works. In a larger scale the firewall makes more sense. but thanks for the hint.
Regarding the approach proposed by @sebastien_picavet, it is a good starting point. Unfortunately, it seems that Nexus Firewall also uses malware databases other than GitHub Advisory(Please note that es5-ext@0.10.64 has not GH advisory present). To be honest, relying on GitHub Advisory is problematic, as it is a vulnerability database — so, in any case, a lot of additional manual checking is needed. You can little improve the process by trying to narrow the search using CWE IDs or relevant keywords.
It appears Nexus 3.83 broke the feature flags discussed here - in fact, it won’t start with them set (and if they’re unset, the banner immediately appears again). Has anyone found another way to remove the banner, or has Sonatype successfully removed that option entirely and we are stuck with it if we update?
