npm modules that contain the name of a CPE are falsely identified in v6.0.0

[aarongoldenthal]

Numerous npm modules that contain the name of a package with a valid CPE are falsely identified as that CPE in v6.0.0 (cli). This did not occur with v5.3.2. See some examples below:

|Vulnerability IDs                          |Package                                                                                                                                                      |Highest Severity                                   |CVE Count|Confidence|Evidence Count|
|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------|---------|----------|--------------|
|@babel/plugin-syntax-json-strings:7.8.3    |cpe:2.3:a:json_project:json:7.8.3:*:*:*:*:*:*:*                                                                                                              |pkg:npm/%40babel%2Fplugin-syntax-json-strings@7.8.3|HIGH     |          |Highest       |
|@types/json-schema:7.0.5                   |cpe:2.3:a:json_project:json:7.0.5:*:*:*:*:*:*:*                                                                                                              |pkg:npm/%40types%2Fjson-schema@7.0.5               |HIGH     |          |Highest       |
|@types/parse-json:4.0.0                    |cpe:2.3:a:json_project:json:4.0.0:*:*:*:*:*:*:* cpe:2.3:a:parsejson_project:parsejson:4.0.0:*:*:*:*:*:*:*                                                    |pkg:npm/%40types%2Fparse-json@4.0.0                |HIGH     |          |Highest       |
|decamelize-keys:1.1.0                      |cpe:2.3:a:decamelize_project:decamelize:1.1.0:*:*:*:*:*:*:*                                                                                                  |pkg:npm/decamelize-keys@1.1.0                      |HIGH     |          |Highest       |
|deep-extend:0.5.1                          |cpe:2.3:a:deep_extend_project:deep_extend:0.5.1:*:*:*:*:*:*:* cpe:2.3:a:extend_project:extend:0.5.1:*:*:*:*:*:*:*                                            |pkg:npm/deep-extend@0.5.1                          |CRITICAL |          |Highest       |
|deep-extend:0.6.0                          |cpe:2.3:a:deep_extend_project:deep_extend:0.6.0:*:*:*:*:*:*:* cpe:2.3:a:extend_project:extend:0.6.0:*:*:*:*:*:*:*                                            |pkg:npm/deep-extend@0.6.0                          |CRITICAL |          |Highest       |
|electron-to-chromium:1.3.480               |cpe:2.3:a:chromium:chromium:1.3.480:*:*:*:*:*:*:* cpe:2.3:a:chromium_project:chromium:1.3.480:*:*:*:*:*:*:* cpe:2.3:a:electron:electron:1.3.480:*:*:*:*:*:*:*|pkg:npm/electron-to-chromium@1.3.480               |HIGH     |          |Highest       |
|escape-string-regexp:1.0.5                 |cpe:2.3:a:string_project:string:1.0.5:*:*:*:*:*:*:*                                                                                                          |pkg:npm/escape-string-regexp@1.0.5                 |HIGH     |          |Highest       |
|escape-string-regexp:2.0.0                 |cpe:2.3:a:string_project:string:2.0.0:*:*:*:*:*:*:*                                                                                                          |pkg:npm/escape-string-regexp@2.0.0                 |HIGH     |          |Highest       |
|extend-shallow:2.0.1                       |cpe:2.3:a:extend_project:extend:2.0.1:*:*:*:*:*:*:*                                                                                                          |pkg:npm/extend-shallow@2.0.1                       |CRITICAL |          |Highest       |
|fast-json-stable-stringify:2.1.0           |cpe:2.3:a:json_project:json:2.1.0:*:*:*:*:*:*:*                                                                                                              |pkg:npm/fast-json-stable-stringify@2.1.0           |HIGH     |          |Highest       |
|is-docker:2.0.0                            |cpe:2.3:a:docker:docker:2.0.0:*:*:*:*:*:*:*                                                                                                                  |pkg:npm/is-docker@2.0.0                            |HIGH     |          |Highest       |
|json-parse-better-errors:1.0.2             |cpe:2.3:a:json_project:json:1.0.2:*:*:*:*:*:*:*                                                                                                              |pkg:npm/json-parse-better-errors@1.0.2             |HIGH     |          |Highest       |
|json-schema-traverse:0.4.1                 |cpe:2.3:a:json_project:json:0.4.1:*:*:*:*:*:*:*                                                                                                              |pkg:npm/json-schema-traverse@0.4.1                 |HIGH     |          |Highest       |
|json-schema:0.2.3                          |cpe:2.3:a:json_project:json:0.2.3:*:*:*:*:*:*:*                                                                                                              |pkg:npm/json-schema@0.2.3                          |HIGH     |          |Highest       |
|json-stable-stringify-without-jsonify:1.0.1|cpe:2.3:a:json_project:json:1.0.1:*:*:*:*:*:*:*                                                                                                              |pkg:npm/json-stable-stringify-without-jsonify@1.0.1|HIGH     |          |Highest       |
|json-stringify-safe:5.0.1                  |cpe:2.3:a:json_project:json:5.0.1:*:*:*:*:*:*:*                                                                                                              |pkg:npm/json-stringify-safe@5.0.1                  |HIGH     |          |Highest       |
|json5:2.1.3                                |cpe:2.3:a:json_project:json:2.1.3:*:*:*:*:*:*:*                                                                                                              |pkg:npm/json5@2.1.3                                |HIGH     |          |Highest       |
|markdownlint-cli:0.23.2                    |cpe:2.3:a:cli_project:cli:0.23.2:*:*:*:*:*:*:*                                                                                                               |pkg:npm/markdownlint-cli@0.23.2                    |HIGH     |          |Highest       |
|npm-run-path:2.0.2                         |cpe:2.3:a:npm:npm:2.0.2:*:*:*:*:*:*:*                                                                                                                        |pkg:npm/npm-run-path@2.0.2                         |HIGH     |          |Highest       |
|parse-json:5.0.0                           |cpe:2.3:a:json_project:json:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:parsejson_project:parsejson:5.0.0:*:*:*:*:*:*:*                                                    |pkg:npm/parse-json@5.0.0                           |HIGH     |          |Highest       |
|rc:1.2.8                                   |cpe:2.3:a:rc_project:rc:1.2.8:*:*:*:*:*:*:*                                                                                                                  |pkg:npm/rc@1.2.8                                   |HIGH     |          |Highest       |
|repeat-string:1.6.1                        |cpe:2.3:a:string_project:string:1.6.1:*:*:*:*:*:*:*                                                                                                          |pkg:npm/repeat-string@1.6.1                        |HIGH     |          |Highest       |
|split-string:3.1.0                         |cpe:2.3:a:string_project:string:3.1.0:*:*:*:*:*:*:*                                                                                                          |pkg:npm/split-string@3.1.0                         |HIGH     |          |Highest       |
|static-extend:0.1.2                        |cpe:2.3:a:extend_project:extend:0.1.2:*:*:*:*:*:*:*                                                                                                          |pkg:npm/static-extend@0.1.2                        |CRITICAL |          |Highest       |
|string-width:3.1.0                         |cpe:2.3:a:string_project:string:3.1.0:*:*:*:*:*:*:*                                                                                                          |pkg:npm/string-width@3.1.0                         |HIGH     |          |Highest       |
|string_decoder:1.3.0                       |cpe:2.3:a:string_project:string:1.3.0:*:*:*:*:*:*:*                                                                                                          |pkg:npm/string_decoder@1.3.0                       |HIGH     |          |Highest       |
|strip-json-comments:2.0.1                  |cpe:2.3:a:json_project:json:2.0.1:*:*:*:*:*:*:*                                                                                                              |pkg:npm/strip-json-comments@2.0.1                  |HIGH     |          |Highest       |
|strip-json-comments:3.1.0                  |cpe:2.3:a:json_project:json:3.1.0:*:*:*:*:*:*:*                                                                                                              |pkg:npm/strip-json-comments@3.1.0                  |HIGH     |          |Highest       |
|strip-json-comments:3.1.1                  |cpe:2.3:a:json_project:json:3.1.1:*:*:*:*:*:*:*                                                                                                              |pkg:npm/strip-json-comments@3.1.1                  |HIGH     |          |Highest       |
|unset-value:1.0.0                          |cpe:2.3:a:set-value_project:set-value:1.0.0:*:*:*:*:*:*:*                                                                                                    |pkg:npm/unset-value@1.0.0                          |CRITICAL |          |Highest       |

[aarongoldenthal]

This is also occurring for other package managers:

Nuget package Microsoft.AspNet.Web.Optimization.WebForms is reported as cpe:2.3:a:forms_project:forms.

[aarongoldenthal]

Another example:

   <suppress>
      <notes><![CDATA[
      file name: cacheable-lookup:2.0.1
      ]]></notes>
      <packageUrl regex="true">^pkg:npm/cacheable\-lookup@.*$</packageUrl>
      <cpe>cpe:/a:lookup:lookup</cpe>
   </suppress>

[jeremylong]

At the moment - I highly recommend just disabling the Node JS Analyzer (--disableNodeJS). There are plans to revamp this analyzer and combine some of the logic in the node audit analyzer. The primary use for the Node JS analyzer will be for the vendor modules.