Sonatype Nexus Repository warns "1 Malware Component Found"

Sonatype Nexus Repository
21

On our side, we have identified: Malware in fsevents · GHSA-xv2f-5jw4-v95m · GitHub Advisory Database · GitHub
Our malwares are all NPM/fsevents things.

Nexus gets its data from https://rhc.sonatype.com/rest/rhc/extras/maliciousContent/{NEXUS_ID} (can be finded on logs) => it allows to identify the registry.

Then, we have scraped malware databases of GitHub: GitHub Advisory Database · GitHub

And for each entry, we have used Nexus API to check if we have one: https://it-dev-fr-nexus.intramatch.eu:8080/service/rest/v1/search?repository=npm-registry&name={MALWARE_COMPONENT}.
=> ~ 50 were identified (among 18000).
Finally, we have checked group/version one by one to identify fsevents

2 Likes
22

Follow-up for this topic:

The recently released version 3.75.0 release introduces a dismiss button for the malware-banner. Thank you, Sonatype, for listening to our feedback! :slight_smile:

Details here:
https://help.sonatype.com/en/sonatype-nexus-repository-3-75-0-release-notes.html#dismiss-the-malware-risk-banner-during-your-session

Have a great day, everyone!
Chris

23

Looks like latest version (3.75.0) added ability to suppress the banner for the current session only: Sonatype Nexus Repository 3.75.0 Release Notes