stacklok / minder / 10925129607

53%

Build Type

push

github

Committed by web-flow

Commit Message

Do not reply that a package has an unfixed vulnerability when in fact it is malicious (#4530)

Malicious packages that have a vulnerability entry `MAL-` are in fact
malicious. Our OSV evaluator handled the `MAL-` vulnerabilities the same
as all the others which meant that it would just reply with "A
vulnerability was found, but no fixed version exists yet".

A malicious package is unlikely to not be malicious again, so let's put
a sterner warning including a link to the vulnerability into the reply.

Fixes: #4528

Run Details

13 of 32 new or added lines in 1 file covered. (40.63%)

2 existing lines in 1 file now uncovered.

13829 of 26180 relevant lines covered (52.82%)

42.98 hits per line