Cxb667b900-bec1 @ Python-azure-powerbiembedded-6969.99.99

[Yoavast]

Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about Cxb667b900-bec1
Applications: yael's application
Checkmarx Project: Yoavast/CX-AST
Repository URL: https://github.com/Yoavast/CX-AST
Branch: main
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
Scan ID: b70b7227-90db-4075-88cb-4c196077be97

---

This package is using dependency confusion attack

About

Dependency Confusion is a technique discovered by @alex.birsan to hijack a privately used package by registering its name (if available) on a public registry with a higher version number. This may cause artifact servers and build tools to "confuse" and use the attacker's package.

For example, consider the following private package "my-company-utils" being hosted on a private artifact server:

In case an attacker targeting "my-company-utils" package, as long as it is not occupied by someone else on the official package manager, he's free to register it. If the attacker registers it and published with a very high version number such as "v99.99.99" most likely the automatic update logic and version comparisons functions will "confuse" and prefer using the attacker's package

As an addition step of mitigation, we recommend using our open-source tool as a CI step DustiLock

---

Additional Info