Sapper Revives Minefield to Deliver Accurate SBOM-Based Vulnerability Impact Reports for Cyber Resilience Act Compliance
Developer Perruer has continued the archived Minefield project from BitBom under the new name Sapper, adding critical fixes that enable accurate answers to the question of which products are affected by a given CVE through direct or transitive dependencies.
The original tool built a dependency graph from SBOMs where each package became a node identified by purl, storing parents and children in roaring bitmaps. Vulnerabilities from OSV were attached as additional nodes, turning impact queries into upward traversals from vulnerable packages. Minefield precomputed transitive closures using Tarjan's algorithm to collapse strongly connected components followed by dynamic programming, achieving O(n + m) performance.
SBOM Direction Bug Discovered After protobom Update
After updating the protobom library from 0.5 to 0.6, end-to-end tests showed dramatically inflated results: instead of six dependent packages, the system reported sixty. Investigation revealed that protobom 0.5 had silently dropped dependsOn edges from CycloneDX files, while version 0.6 correctly parsed both CycloneDX and SPDX relationships. The original Minefield code treated every edge as “from depends on to,” which is correct for CycloneDX but incorrect for SPDX predicates such as runtimeDependencyOf or containedBy that reverse the direction.
The fix introduces an explicit direction table that classifies each sbom.Edge_Type as fromDependsOnTo, toDependsOnFrom, or notADependency. After correction, test expectations were updated and independently verified by a Python script that parsed the same SBOM JSON files according to the CycloneDX and SPDX specifications.
Additional Reliability Fixes
- Replaced mattn/go-sqlite3 with glebarez/sqlite to produce a single static binary without cgo.
- Configured in-memory databases to use a single connection and enabled WAL mode with busy_timeout for file-based storage.
- Fixed OSV range sorting that previously compared versions from the wrong slice, causing incorrect vulnerability status for multi-range records and Go pseudo-versions.
- Added a package-name index that reduced full Go OSV database loading from tens of minutes to 7–8 seconds.
The new sapper report command traverses the cached graph to produce prioritized vulnerability impact lists ordered first by CISA KEV presence, then by EPSS score, then by number of affected products. It merges duplicate findings via alias relationships and respects OpenVEX documents that mark specific products as not affected.
Sapper remains fully air-gapped, accepts CycloneDX and SPDX files or archives, and can ingest KEV, EPSS, and OSV data. The project is available at github.com/Perruer/sapper under the Apache-2.0 license.
Related articles
Fake Terraform Providers on HashiCorp Registry Distribute Go Malware to Developers
Cybersecurity researchers have identified Go-based malware distributed through two fake Terraform providers and two Go modules hosted on the official HashiCorp registry. The providers gocommunity-io/dockerd and kreuzwenker/docker, along with modules gocommunity.io/orderedbtree and gogets.dev/btreex, impersonate legitimate projects and represent the first documented case of malicious code being delivered via the HashiCorp registry. Attackers approach developers on LinkedIn, Facebook, and job forums using fake Web3 company profiles, then supply seemingly harmless repositories whose malicious behavior is triggered through npm or PyPI dependencies. Once executed, the malware collects hardware attributes, operating system data, hostname, and node availability before sending the information to attacker infrastructure. Command and control relies on a Slack channel polled every ten seconds and encrypted commands read from Sepolia testnet Ethereum smart contracts every three seconds, with each infected client using ephemeral key pairs for targeted delivery. The code matches the Graphalgo campaign previously documented by ReversingLabs and attributed to North Korean actors.
Challenges in Building Accurate SBOMs for C and C++ Projects Highlighted by CodeScoring Analysis
C and C++ ecosystems lack centralized package manifests, making SBOM generation far more complex than in Python, Java, or JavaScript. Libraries may arrive through system package managers like apt or dnf, build tools such as Conan and vcpkg, or direct source inclusion, with no single record of all components. CodeScoring’s Johnny agent uses eBPF to observe linker commands during builds and cross-references results with dpkg, RPM, and pkg-config metadata. The analysis distinguishes build-time SBOMs, which capture static libraries and compilation commands, from runtime SBOMs that reflect dynamic dependencies at execution. When version data cannot be verified, components are explicitly marked unresolved rather than guessed. The approach also addresses header-only libraries and patched artifacts that defeat simple hash matching.
CrowdSec Confirms Theft of Source Code from Roughly 300 GitHub Repositories via TanStack Supply Chain Attack
French cybersecurity firm CrowdSec has confirmed that attackers stole source code from approximately 300 GitHub repositories, including around 170 private ones. The breach occurred in May 2026 through a compromised TanStack component that exfiltrated an API key with read access to the private codebase. The stolen material included code for the company's SaaS console, AWS procedures, connectors, and automation tools, while the remaining repositories contained already-public open source code. No customer data, passwords, organization details, tokens, or other secrets were included in the leak, and all potentially affected credentials were immediately rotated. CrowdSec stated that the code is tightly integrated with internal systems and has largely changed over the past four months, reducing its usefulness outside the company's environment. The SaaS service code undergoes regular audits, and the company sees no immediate threat from the exposure while the investigation continues.
Dependency Confusion Attacks Let Attackers Hijack Internal Library Names in Corporate Builds
A widespread supply chain risk allows attackers to publish packages with internal company names on public registries such as npm and PyPI, causing build systems to pull malicious versions instead of internal ones. The attack works because package managers treat multiple registries as a single list and select the highest version number, with no inherent priority for internal sources. Researcher Alex Birsan demonstrated the technique in February 2021 by registering names harvested from open repositories and error messages, successfully injecting packages into builds at Microsoft, Apple, PayPal, Shopify, Netflix, Tesla and Uber. The malicious code executes during installation because setup scripts and lifecycle hooks run with the privileges of the build agent, exposing environment variables, tokens and internal network access. Mitigation requires a single internal proxy repository that never mixes public responses for internal package names, scoped namespaces bound to private registries, lock files with content hashes, and disabling install scripts where possible. The technique remains effective against any organization that lists both internal and public registries in its build configuration.