[VULNERABLE PACKAGE]: wicg-inert package still not completely removed from @carbon/[email protected]

[PatrikHysky]

Description

Follow up to #11919

Even after this fix, the vulnerable wicg-inert package is still being installed with @carbon/[email protected] as a dependency.

@carbon/[email protected] has a dependency on "carbon-components-react": "7.59.17" which in turn has a dependency on wicg-inert

This triggers a policy check failure during deployment on IBM CIO Hybrid Cloud Cirrus.

Getting policy evaluations
Found results for mend-scan
Successfully retrieved all evaluations

ITSS Chapter 5 2.3c:
Remediate or otherwise appropriately address before release of the IBM Product or Application all Critical and High severity vulnerabilities identified via security testing and which may affect the IBM Product or Application, including open source vulnerabilities.

We found 1 policy violations from mend-scan for this build.
Please resolve the following policy violations prior to release: 

ID: MSC-2024-9045
Score: 9.8
Source: null
Severity: critical
Library: wicg-inert	3.1.2
Description: This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running (user's machine or backend server). The following risks were identified: Malware dropper – this package contains a Trojan horse, allowing the unauthorized installation of other potentially malicious software.

Component(s) impacted

all

Browser

No response

Carbon for IBM.com version

1.61.0

Severity

Severity 2 = Aspects of design is broken, and impedes users in a significant way, but there is a way to complete their tasks. Affects major functionality, has a workaround.

Application/website

IBM Redbooks

Package

@carbon/ibmdotcom-web-components, @carbon/web-components, @carbon/ibmdotcom-styles, @carbon/ibmdotcom-services, @carbon/ibmdotcom-utilities

CodeSandbox example

none

Steps to reproduce the issue (if applicable)

No response

Release date (if applicable)

No response

Code of Conduct

• I agree to follow this project's Code of Conduct
• I checked the current issues for duplicate issues

[techtolentino]

We're getting the same Critical severity warning in our code base

[techtolentino]

@annawen1 - thanks for these updates.

I'm a little confused - which version of @carbon/ibmdotcom-web-components can we use, so we don't have the wicg-inert subdependency?

[techtolentino]

@annawen1 - disregard, I think I'm confusing the packages and sub-deps