NPM audit shows moderate vulnerabilities alert
- Dominant language
- JavaScript
- Stars
- 9.4k
- Forks
- 858
- PR merge metrics
- No merged PRs in 30d
Description
On version 0.11.6
npm audit shows the following moderate vulnerabilities alert:
```
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ extend │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=2.0.2 <3.0.0 || >=3.0.2 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ kue │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ kue > node-redis-warlock > node-redis-scripty > extend │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/996 │
└───────────────┴──────────────────────────────────────────────────────────────┘
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by running npm audit for version 0.11.6 and trace the reported path from kue through node-redis-warlock and node-redis-scripty to extend. Review the available dependency declarations and the patched versions in the report; done means the moderate prototype-pollution alert is no longer reported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js, redis
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100