SecFlowX Story No. 1 — Vulnerable Packages Without a CVE
- Software supply-chain attacks target the packages thousands of projects depend on.
- SCA tools rely on a CVE existing in the NVD — malicious packages without a CVE slip through.
- Package inventory tracking (as in SecFlowX) detects known-bad dependencies with no CVE at all.
Over the past years, open-source libraries and components have become an indispensable part of how we build software. Thanks to the power of the community we have access to battle-tested components that solve everything from trivial to complex problems — code that has been reviewed by many people and hardened in proportion to its usage.
That is the half-full side of the glass. On the empty side sit malicious actors. Libraries known to be used by thousands — even millions — of people are an attractive target for reaching a large audience at once, or for infiltrating their systems. This is why attackers today target projects hosted on package registries such as NPM, PyPI and GitHub.
If an attacker successfully compromises a package or application, they gain simultaneous access to every system that depends on it — the essence of a software supply-chain attack.
CVE → NVD → SCA
The flow from a vulnerability being discovered in a library, to being recorded in the NVD (National Vulnerability Database), to becoming usable by scanning tools, lets us use SCA (Software Composition Analysis) tools to determine whether a researcher-reported vulnerability exists in our organisation's projects.
Where SecFlowX fits
SecFlowX provides a detailed view at both the project and organisation level. Application dependencies and their vulnerability status can be obtained either through CI/CD integration or through scans triggered directly from SecFlowX.
Vulnerabilities without a CVE
But what about a malicious package or application that has no CVE identifier? One of the most concerning issues for organisations right now is malicious packages with no CVE. The malicious code injected into LiteLLM is one of the clearest examples — no CVE had been assigned at the time.
A grype scan against a sample project pinning litellm==1.82.8 returns no detection for the vulnerable package. This is not the fault of grype or any SCA tool — the database simply has no such record.
So how do we solve it? The answer is clear: through package inventory tracking. If we know all the dependencies and version information of our organisation's projects, we can check whether any affected component is present. Scanning the same project through SecFlowX confirms that the known-vulnerable litellm==1.82.8 library is present in our inventory — achieved without needing any CVE identifier at all.
Summary
Software supply-chain attacks and the defences against them grow more critical every day. Knowing which components exist in an organisation's inventory is no longer optional — it is a hard requirement. SecFlowX helps make your existing application-security processes safer and more sustainable.
Frequently asked questions
Why can't SCA tools detect a vulnerable package without a CVE?
SCA tools like grype match your dependencies against vulnerability databases such as the NVD. If no CVE record exists for a malicious or vulnerable package, there is nothing to match against — so the scan returns clean even though the risk is real.
How does package inventory tracking help?
By knowing exactly which packages and versions run across your organisation, you can check for an affected component the moment it is disclosed — without waiting for a CVE. SecFlowX confirmed a known-vulnerable litellm==1.82.8 purely from inventory.