Inspector showing false positives for javascript packages

Question

Hello, after the latest changes to the inspector, scans of our containers show active vulnerabilities for packages we have updated a long time ago. For example, 
```
word-wrap
```
I have installed both Inspector version 1.5 and 1.6 and run the scans manually on a snapshot of a container locally. I am not sure how exactly the vulnerability results are derived from the scan output, but here's the difference between the output of the versions for the `word-wrap` package:

version 1.6:

```
  {
      "bom-ref": "comp-2198",
      "type": "library",
      "name": "word-wrap",
      "version": "1.2.3",
      "purl": "pkg:npm/word-wrap@1.2.3",
      "properties": [
        {
          "name": "amazon:inspector:sbom_generator:source_path",
          "value": "/usr/local/bundle/gems/shakapacker-7.2.3/yarn.lock"
        }
      ]
    },
...
{
      "bom-ref": "comp-2347",
      "type": "library",
      "name": "@aashutoshrathi/word-wrap",
      "version": "1.2.6",
      "purl": "pkg:npm/%40aashutoshrathi/word-wrap@1.2.6",
      "properties": [
        {
          "name": "amazon:inspector:sbom_generator:source_path",
          "value": "/opt/app/node_modules/@aashutoshrathi/word-wrap/package.json"
        }
      ]
    },
```
version 1.5

```
{
      "bom-ref": "comp-658",
      "type": "library",
      "name": "@aashutoshrathi/word-wrap",
      "version": "1.2.6",
      "purl": "pkg:npm/%40aashutoshrathi/word-wrap@1.2.6",
      "properties": [
        {
          "name": "amazon:inspector:sbom_generator:source_path",
          "value": "/opt/app/yarn.lock"
        }
      ]
    },
...
{
      "bom-ref": "comp-2553",
      "type": "library",
      "name": "word-wrap",
      "version": "1.2.3",
      "purl": "pkg:npm/word-wrap@1.2.3",
      "properties": [
        {
          "name": "amazon:inspector:sbom_generator:source_path",
          "value": "/usr/local/bundle/gems/shakapacker-7.2.3/yarn.lock"
        }
      ]
    },
...
{
      "bom-ref": "comp-4547",
      "type": "library",
      "name": "@aashutoshrathi/word-wrap",
      "version": "1.2.6",
      "purl": "pkg:npm/%40aashutoshrathi/word-wrap@1.2.6",
      "properties": [
        {
          "name": "amazon:inspector:sbom_generator:source_path",
          "value": "/opt/app/node_modules/@aashutoshrathi/word-wrap/package.json"
        }
      ]
    },
```
It seems that the latest version doesn't create an artifact for the package in yarn.lock, where the package dependencies are resolved to a non-vulnerable version 1.2.6

```
"@aashutoshrathi/word-wrap@npm:^1.2.3":
  version: 1.2.6
  resolution: "@aashutoshrathi/word-wrap@npm:1.2.6"
  checksum: 10c0/53c2b231a61a46792b39a0d43bc4f4f776bb4542aa57ee04930676802e5501282c2fc8aac14e4cd1f1120ff8b52616b6ff5ab539ad30aa2277d726444b71619f
  languageName: node
  linkType: hard
```
Now we depend on ECR scan as an evidence that our secure and these false positives are hindering with our monthly report. Can we expect a fix soon?

re:Post Agent · Answer

Thank you for bringing this issue to our attention. It appears that you're experiencing some discrepancies in the way Amazon Inspector is scanning and reporting vulnerabilities for JavaScript packages, specifically the 'word-wrap' package, after a recent update.

Based on the information you've provided, it seems that Inspector version 1.6 is not correctly identifying the resolved version of the 'word-wrap' package from your yarn.lock file. This could indeed lead to false positive reports of vulnerabilities for packages that have actually been updated.

The issue appears to stem from how the Amazon Inspector SBOM Generator handles unresolved or range-based version references in package manifests like package.json or yarn.lock. The SBOM Generator does not resolve version ranges or perform registry lookups, which can lead to situations where it reports an older, potentially vulnerable version instead of the actually installed, updated version.

For accurate vulnerability scanning and SBOM generation, it's recommended to use resolved, semantic version identifiers in your project dependencies. However, in your case, it seems that even though you have the resolved version in your yarn.lock file, the latest Inspector version is not picking it up correctly.

This is likely an unintended consequence of recent changes to the Inspector, and it's reasonable to expect that AWS will address this issue. While I can't provide a specific timeline for a fix, AWS typically responds quickly to such issues, especially when they impact security assessments and reporting.

In the meantime, you might consider:

1. Documenting these false positives and their actual resolved versions for your monthly reports.
2. If possible, explicitly specifying the updated versions in your package.json file as well as yarn.lock.
3. Reaching out to AWS support to report this specific issue, as they may be able to provide more immediate guidance or workarounds.

Rest assured that AWS is continually working to improve their services, and addressing false positives in security scans is typically a high priority. Keep an eye out for updates to Amazon Inspector, as a fix for this issue is likely to be included in a future release.  
**Sources**  
[Handling unresolved or non-standard version references in the Amazon Inspector SBOM Generator - Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/sbom-generator-unresolved-non-standard-version-reference.html)

Inspector showing false positives for javascript packages

Add your answer

Relevant content