PRP: Extractor for Dart package_config.json

[sanjay20m]

• Software distribution method or binary type: Dart package configuration (.dart_tool/package_config.json).
• Popularity of distribution method: Dart and Flutter use the Pub ecosystem, which contains tens of thousands of packages and serves millions of developers. The package_config.json file is a standard artifact in every Dart and Flutter application created since Dart 2.8. It is generated during dart pub get or flutter pub get and explicitly maps all installed dependencies to their cached file locations, capturing the exact runtime dependency tree.
• Any critical, emergent vulnerability associated with software from the distribution method: The OSV.dev database natively supports the Pub ecosystem. While there is no single emergent CVE, supply chain risks in widely-used Flutter packages (like http or webview_flutter) are common. SCALIBR currently extracts dependencies from the pubspec.lock manifest. Extracting from package_config.json is highly complementary, as it acts as a deployed/runtime artifact that reflects exactly which packages the Dart build system resolved and installed locally, similar to Go's vendor/modules.txt or PHP's installed.json.
• Resources:
  • Package config specification: https://dart.dev/go/package-config
  • Dart dependencies documentation: https://dart.dev/tools/pub/dependencies
  • OSV Pub ecosystem: https://osv.dev/list?ecosystem=Pub
  • Current supported SCALIBR inventory: https://github.com/google/osv-scalibr/blob/main/docs/supported_inventory_types.md

[github-actions]

Welcome to the OSV-SCALIBR patch reward program!
Your issue has been added to our triage queue and will reviewed
shortly. The panel usually takes a decision once every other week,
so it can take up to two weeks before you hear back from us,
sometimes longer depending on available capacity.
Please, do not start the work until the panel has reached a
decision. Although we always welcome contributions, unapproved
work is not eligible for a reward.
For more details, please see the rules page.
~The OSV-SCALIBR PRP team

[another-rex]

Thank you for the proposal. We are happy to accept this PRP! Please feel free to start working on it.

[github-actions]

Congratulations, your request has been approved! 🎉
This means that you can start working on this contribution.
❗ Please take a moment to fill the participation form
If you are unsure where to start, we have compiled a set of
useful guides in our documentation:

• Writing a new vulnerability detector plugin
• Writing a new inventory extraction plugin
• Writing a new secret detector plugin
• General style guide

~The OSV-SCALIBR PRP team

[sanjay20m]

Hey @another-rex

I've just opened PR #2295 which implements the package_config.json extractor we discussed.

Thank you so much!