DHowe452209 (Community Member) asked a question.
I have strange packages showing up in SCA results - packages that are not used (or mentioned) in my application
I have performed an agent based scan of my repository and the results are showing up issues with packages, such as "Citrix.CloudServices.Automation.Deployment.Content", which are not referenced in the application; in fact, they do not exist on our package repositories anywhere!
Is there a way for me to ensure that the scan results only include the packages that are listed in the "packages.config" file (i.e. only the ones we use)?
.png){kind=logo}
Have you checked if they are transitive dependencies(used by your dependencies)?
Apologies for the slow response - I have been investigating.
I can confirm that none of my packages have a dependency upon the erroneous packages. If you look on NuGet itself, the Citrix package I mention has been unlisted, but that doesn't mean something isn't still dependent on it.
If I recall correctly from the POV we did with Veracode, the scanner does something with the source files and matches up packages that way. I can only assume that this is what is happening, but I need to know how to make it not do it because reporting these packages are misleading.
@DHowe452209 (Community Member) Just curious if you ever got to the bottom of this?