Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

False Positives For Dependency confusion because of extra character...

Steven | Last updated: May 13, 2023 03:01PM UTC

To Whom it may concern, When opening a package-lock.json file in the browser with burp running, BurpSuite falsly identifies a HIGH Vulnerabilty know as Dependency Confusion every time... This is occuring because the "{" character is being added in the query to npm to identify the package name. This issue can be fixed by removing the "{" from the search query to npm... I abosoluty suck at coding which is why i cant do it myself and am asking for help... Thank you for your time and hope this issue is fixed soon thank you...

Hannah, PortSwigger Agent | Last updated: May 15, 2023 04:17PM UTC

Hi It sounds like an extension may have raised this issue - perhaps JS Miner? We don't have a native scan check for "Dependency Confusion" - you can check out native scan checks here: https://portswigger.net/burp/documentation/scanner/vulnerabilities-list We'd recommend raising this as an issue with the extension author on their repo. Assuming this is JS Miner, you can find this here: https://github.com/minamo7sen/burp-JS-Miner/issues

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.