99x / 99x/serverless-dynamodb-local
Security issue in node.extend dependency
- Dominant language
- JavaScript
- Stars
- 621
- Forks
- 232
- PR merge metrics
- No merged PRs in 30d
Description
`npm audit` is issuing a warning about a vulnerability inside the node.extend, which is a dependency of dynamodb-locahost. I see there is an issue opened there: https://github.com/99xt/dynamodb-localhost/issues/38
Just a reminder to update this package too once dynamodb-locahost is updated. π
````
=== npm audit security report ===
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Manual Review β
β Some vulnerabilities require your attention to resolve β
β β
β Visit https://go.npm.me/audit-guide for additional guidance β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
βββββββββββββββββ¬βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Moderate β Prototype Pollution β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Package β node.extend β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Patched in β >=1.1.7 <2.0.0 || >= 2.0.1 β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Dependency of β serverless-dynamodb-local [dev] β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Path β serverless-dynamodb-local > dynamodb-localhost > rmdir > β
β β node.flow > node.extend β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β More info β https://nodesecurity.io/advisories/781 β
βββββββββββββββββ΄βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
found 1 moderate severity vulnerability in 3906 scanned packages
1 vulnerability requires manual review. See the full report for details.
````
Contributor guide
Research direction
Start with the npm audit report and its dependency path: serverless-dynamodb-local > dynamodb-localhost > rmdir > node.flow > node.extend. Check the linked dynamodb-localhost issue for the upstream update, then verify the resolved dependency with npm audit; done means the reported vulnerability is gone.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100