feat: add @ctrl/tinycolor and 40+ packages #277
Conversation
|
Caution Review failedThe pull request is closed. Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughAdded a large block of vulnerability/version mappings to Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10–15 minutes Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
Tip 👮 Agentic pre-merge checks are now available in preview!Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.
Please see the documentation for more information. Example: reviews:
pre_merge_checks:
custom_checks:
- name: "Undocumented Breaking Changes"
mode: "warning"
instructions: |
Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).Please share your feedback with us on this Discord post. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello @BlackHole1, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request proactively addresses the recent tinycolor supply chain attack by updating the package.json to include explicit references and reasons for over 40 packages. This change ensures that the project maintains a clear record of dependencies impacted by the vulnerability, facilitating better security posture and dependency management.
Highlights
- Security Vulnerability Tracking: This pull request introduces explicit tracking for numerous packages affected by or related to the
tinycolorsupply chain attack, as detailed in the referencedsocket.devblog post. - Package Additions: Over 40 new package entries have been added to
package.json, including@ctrl/tinycolorand a wide range of other@ctrland@nativescript-communitypackages, each with a specific version and a direct link to the security incident.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in pull request comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request adds over 40 packages to the bug-versions list that were affected by the @ctrl/tinycolor supply chain attack. While adding these is important for security, there is a critical issue with the data provided. The 'safe' version specified for each buggy package version is the same as the buggy version itself without any other remediation, which is incorrect and could cause problems for tools that consume this data. This needs to be corrected for all new entries.
package.json
Outdated
| }, | ||
| "angulartics2": { | ||
| "14.1.2": { | ||
| "version": "14.1.2", |
There was a problem hiding this comment.
version field should point to 14.1.0
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
package.json(1 hunks)
🔇 Additional comments (2)
package.json (2)
1455-1463: Pin @ctrl/tinycolor to a confirmed-safe release (package.json lines 1455–1463).
No authoritative GHSA/CVE or maintainer advisory listing exact affected versions was found as of Sep 16, 2025; Socket.dev and community reports describe a malicious postinstall but do not name precise tags. Confirm the first clean published version (or roll back to the last-known-good), update package.json to pin that safe version instead of leaving 4.1.1/4.1.2 mapped to themselves, and replace the reason fields with per-version GHSA/CVE/maintainer/npm advisory links for traceability.
1388-1627: Cite package‑specific advisories (GHSA/CVE) or confirm none existSearched GHSA/OSV/Snyk/npm for the top‑10 packages you listed (angulartics2, ngx-color, ngx-toastr, koa2-swagger-ui, json-rules-engine-simplified, @ctrl/ngx-emoji-mart, @ctrl/qbittorrent, @nativescript-community/ui-image, react-complaint-image, swc-plugin-component-annotate) — no official advisories or impacted/patched version ranges found as of Sep 16, 2025. Keep the blog post link for context, but either: (a) add package‑level GHSA/CVE links per affected version when available, or (b) annotate each package.json entry with a link to the package’s Snyk/npm/OSV page and a short “no advisories found” note for auditability.
Signed-off-by: Kevin Cui <bh@bugs.cc>
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
package.json (1)
1388-1393: angulartics2: correct remediation to 14.1.0.This addresses the prior reviewer’s note to point to 14.1.0. (socket.dev)
🧹 Nitpick comments (1)
package.json (1)
1388-1635: Keep bug-versions keys alphabetized for maintainability.New entries are appended after “supports-hyperlinks” instead of being placed alphabetically (e.g., angulartics2 should be under “a”). Consider reordering in a follow‑up.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
package.json(1 hunks)
🔇 Additional comments (2)
package.json (2)
1454-1463: Good pin: @ctrl/tinycolor 4.1.1/4.1.2 → 4.1.0 aligns with the published compromised versions.This matches Socket’s list of affected versions and reverts to the last known‑good 4.1.0. (socket.dev)
1506-1515: Sanity check: these packages/versions are listed as compromised; remediations look consistent.The added set mirrors Socket’s compromised list (koa2-swagger-ui, Nativescript Community packages, ngx-, rxnt-, swc-plugin-component-annotate, ts-gaussian, etc.) and pins to the immediately prior versions.
If you want an automated cross-check, I can generate a scraper to compare our set against the blog’s “Compromised Packages and Versions” list. (socket.dev)
Also applies to: 1528-1569, 1570-1587, 1606-1623, 1624-1635
| "angulartics2": { | ||
| "14.1.2": { | ||
| "version": "14.1.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@ctrl/deluge": { | ||
| "7.2.2": { | ||
| "version": "7.2.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@ctrl/golang-template": { | ||
| "1.4.3": { | ||
| "version": "1.4.1", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@ctrl/magnet-link": { | ||
| "4.0.4": { | ||
| "version": "4.0.2", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@ctrl/ngx-codemirror": { | ||
| "7.0.2": { | ||
| "version": "7.0.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@ctrl/ngx-csv": { | ||
| "6.0.2": { | ||
| "version": "6.0.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@ctrl/ngx-emoji-mart": { | ||
| "9.2.2": { | ||
| "version": "9.2.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@ctrl/ngx-rightclick": { | ||
| "4.0.2": { | ||
| "version": "4.0.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@ctrl/qbittorrent": { | ||
| "9.7.2": { | ||
| "version": "9.7.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@ctrl/react-adsense": { | ||
| "2.0.2": { | ||
| "version": "2.0.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@ctrl/shared-torrent": { | ||
| "6.3.2": { | ||
| "version": "6.3.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@ctrl/tinycolor": { | ||
| "4.1.1": { | ||
| "version": "4.1.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| }, | ||
| "4.1.2": { | ||
| "version": "4.1.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@ctrl/torrent-file": { | ||
| "4.1.2": { | ||
| "version": "4.1.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@ctrl/transmission": { | ||
| "7.3.1": { | ||
| "version": "7.3.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@ctrl/ts-base32": { | ||
| "4.0.2": { | ||
| "version": "4.0.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "encounter-playground": { | ||
| "0.0.5": { | ||
| "version": "0.0.4", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "json-rules-engine-simplified": { | ||
| "0.2.1": { | ||
| "version": "0.2.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| }, | ||
| "0.2.2": { | ||
| "version": "0.2.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| }, | ||
| "0.2.3": { | ||
| "version": "0.2.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| }, | ||
| "0.2.4": { | ||
| "version": "0.2.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "koa2-swagger-ui": { | ||
| "5.11.1": { | ||
| "version": "5.11.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| }, | ||
| "5.11.2": { | ||
| "version": "5.11.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@nativescript-community/gesturehandler": { | ||
| "2.0.35": { | ||
| "version": "2.0.34", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@nativescript-community/sentry": { | ||
| "4.6.43": { | ||
| "version": "4.6.42", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@nativescript-community/text": { | ||
| "1.6.13": { | ||
| "version": "1.6.9", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@nativescript-community/ui-collectionview": { | ||
| "6.0.6": { | ||
| "version": "6.0.5", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@nativescript-community/ui-drawer": { | ||
| "0.1.30": { | ||
| "version": "0.1.29", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@nativescript-community/ui-image": { | ||
| "4.5.6": { | ||
| "version": "4.5.5", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@nativescript-community/ui-material-bottomsheet": { | ||
| "7.2.72": { | ||
| "version": "7.2.71", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@nativescript-community/ui-material-core": { | ||
| "7.2.76": { | ||
| "version": "7.2.71", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "@nativescript-community/ui-material-core-tabs": { | ||
| "7.2.76": { | ||
| "version": "7.2.71", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "ngx-color": { | ||
| "10.0.2": { | ||
| "version": "10.0.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "ngx-toastr": { | ||
| "19.0.2": { | ||
| "version": "19.0.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "ngx-trend": { | ||
| "8.0.1": { | ||
| "version": "8.0.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "react-complaint-image": { | ||
| "0.0.35": { | ||
| "version": "0.0.34", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "react-jsonschema-form-conditionals": { | ||
| "0.3.21": { | ||
| "version": "0.3.20", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "react-jsonschema-form-extras": { | ||
| "1.0.4": { | ||
| "version": "1.0.3", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "rxnt-authentication": { | ||
| "0.0.6": { | ||
| "version": "0.0.5", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "rxnt-healthchecks-nestjs": { | ||
| "1.0.5": { | ||
| "version": "1.0.4", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "rxnt-kue": { | ||
| "1.0.7": { | ||
| "version": "1.0.6", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "swc-plugin-component-annotate": { | ||
| "1.9.2": { | ||
| "version": "1.9.0", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| }, | ||
| "ts-gaussian": { | ||
| "3.0.6": { | ||
| "version": "3.0.4", | ||
| "reason": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages" | ||
| } | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
Guard against future “identity mappings.”
Add a CI check that rejects entries where “version” equals the vulnerable key without script overrides.
🏁 Script executed:
#!/bin/bash
# Fail if any mapping is an identity (no-op remediation)
set -euo pipefail
bad=$(jq -r '
.config["bug-versions"] | to_entries[] |
.key as $pkg | .value |
to_entries[] |
select(.value | type=="object") |
select(.value.version == .key and (.value.scripts | not)) |
"\($pkg)@\(.key)"
' package.json)
if [[ -n "$bad" ]]; then
echo "Identity mappings detected (no remediation):"
echo "$bad"
exit 1
fi
echo "OK: no identity mappings"Length of output: 58
Reject identity mappings in CI — fix accord@0.28.0
Identity mapping found: package.json → .config["bug-versions"]["accord"]["0.28.0"] (version == key, no scripts). Add the CI check and either add a remediation script or update/remove this mapping.
🤖 Prompt for AI Agents
In package.json around lines 1388 to 1635 there is an identity mapping for
accord@0.28.0 (key == version) flagged by CI; implement the CI rule to reject
identity mappings and fix this mapping by either removing or changing the
.config["bug-versions"]["accord"]["0.28.0"] entry (so the key differs from the
version) or add a remediation script under "scripts" that explicitly
updates/remediates this mapping (and reference it in the CI check). Ensure the
CI job fails on identity mappings and that package.json includes either the
remediation script or the corrected mapping entry before re-running CI.
🧩 Analysis chain
Verify all target versions exist on the npm registry (and are installable).
Quick check script to fail fast if any mapped “version” doesn’t exist (HTTP ≠ 200).
🏁 Script executed:
#!/bin/bash
# Verify each {pkg, version} target in config.bug-versions exists on registry.npmjs.org
set -euo pipefail
jq -r '
.config["bug-versions"] | to_entries[] |
.key as $pkg | .value |
to_entries[] |
select(.value.version? and (.value.version | type=="string")) |
[$pkg, .value.version] | @tsv
' package.json | while IFS=$'\t' read -r pkg ver; do
enc_pkg="$(python - <<PY
import sys, urllib.parse as u; print(u.quote(sys.argv[1], safe=""))
PY
"$pkg")"
url="https://registry.npmjs.org/${enc_pkg}/${ver}"
code=$(curl -s -o /dev/null -w '%{http_code}' "$url")
if [[ "$code" != "200" ]]; then
echo "ERROR: $pkg target version $ver not found ($code) -> $url"
exit 1
fi
done
echo "OK: all target versions exist"Length of output: 60
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
jq -r '
.config["bug-versions"] | to_entries[] |
.key as $pkg | .value |
to_entries[] |
select(.value.version? and (.value.version | type=="string")) |
"\($pkg)\t\(.value.version)"
' package.json > /tmp/bug_versions.tsv
if [ ! -s /tmp/bug_versions.tsv ]; then
echo "ERROR: no entries found in package.json .config[\"bug-versions\"]" >&2
exit 1
fi
while IFS=$'\t' read -r pkg ver; do
enc_pkg="${pkg//@/%40}"
enc_pkg="${enc_pkg//\//%2F}"
url="https://registry.npmjs.org/${enc_pkg}/${ver}"
code=$(curl -s -o /dev/null -w '%{http_code}' "$url" || echo "000")
case "$code" in
200) ;;
*)
echo "ERROR: $pkg target version $ver not found ($code) -> $url"
exit 1
;;
esac
done < /tmp/bug_versions.tsv
echo "OK: all target versions exist"Length of output: 95
Fix missing npm target synk@1.1044.0
Validation failed — npm registry returned 404 for synk@1.1044.0 (registry.npmjs.org/synk/1.1044.0). Update .config["bug-versions"].synk in package.json (lines 1388–1635) to a published version, correct the package name, or remove the entry.
🤖 Prompt for AI Agents
In package.json around lines 1388–1635, the .config["bug-versions"].synk entry
references a non-existent npm version synk@1.1044.0 causing a 404; fix it by
either correcting the package name to the intended package (e.g., "snyk" if that
was intended), updating the synk version to a published one, or removing the
synk entry entirely from .config["bug-versions"]; after updating, run a quick
npm pack or npm view <package> to verify the chosen package/version exists and
commit the change.
|
🎉 This PR is included in version 1.117.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
2 participants
Ref: https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages
Summary by CodeRabbit