GHSA-c8j3-f9pr-q5jg: 
JavaScript 취약점 분석 및 완화

Summary

In a Yarn classic (v1) project, a dependency declared through an npm alias, for example "util-lib": "npm:lodash@4.17.20", is looked up under the wrong package name. Yarn 1.22 writes the lockfile key util-lib@npm:lodash@4.17.20 and installs lodash@4.17.20, but the Yarn classic parser takes everything before the last @ as the name, so the scan queries OSV for util-lib@npm:lodash, finds nothing, and reports "No known vulnerabilities found".

Impact

The scan exits 0 even under --fail-on high, so a CI gate relying on the scanner passes over a known vulnerable package. The same lodash@4.17.20 declared directly reports 4 CVEs, including CVE-2021-23337, and exits 1. Confirmed on v1.41.0 and on main at 77bde74.

Fix

Treat @npm: as the alias marker in the Yarn classic parser and the Yarn lock graph, keep the install name, and resolve the registry package (scoped targets and the no-range form included). After the fix the same project reports the 4 CVEs, suggests yarn add util-lib@npm:lodash@4.18.1, and exits 1. Reported by @alex-powell.