[FP]: Spatie Laravel packages are matched as Laravel framework

[sigv]

Package URl

pkg:composer/spatie/[email protected]

CPE

cpe:2.3:a:laravel:laravel:3.7.3:*:*:*:*:*:*:*

CVE

CVE-2018-15133

ODC Integration

{"label" => "CLI"}

ODC Version

12.1.1

Description

Spatie provides various Laravel (PHP) packages. Quoting their website:

[Spatie has] created more than 500 packages for Laravel and PHP. These packages have been downloaded a whopping 1.58 billion times!

Their naming scheme follows spatie/laravel-project-name format, where all project names are prefixed with laravel. This however results in a match for laravel/framework project, even if it's really spatie/laravel-sluggable or other. There is no shared versioning scheme, as the framework has latest version at v12.8.1, while the Sluggable extension by Spatie has latest version at 3.7.4.