Vulnerabilities in packages - NPM
- 主要言語
- TypeScript
- スター
- 25.7k
- フォーク
- 7.9k
- PR マージ指標
- 30日以内にマージされた PR はありません
説明
### Issue type
**I'm submitting a ...** (check one with "x")
* [ ] bug report
* [ ] feature request
* [x] question about the decisions made in the repository
### Issue description
**Current behavior:**
When I run npm install npm informs me that it found 22 vulnerabilities.
I leave report.
`found 22 vulnerabilities (11 low, 5 moderate, 6 high)
run `npm audit fix` to fix them, or `npm audit` for details
`
```
# Run npm install --save-dev karma@2.0.4 to resolve 13 vulnerabilities
SEMVER WARNING: Recommended action is a potentially breaking change
Low Prototype Pollution
Package lodash
Dependency of karma [dev]
Path karma > lodash
More info https://nodesecurity.io/advisories/577
Low Regular Expression Denial of Service
Package debug
Dependency of karma [dev]
Path karma > socket.io > debug
More info https://nodesecurity.io/advisories/534
Low Regular Expression Denial of Service
Package debug
Dependency of karma [dev]
Path karma > socket.io > engine.io > debug
More info https://nodesecurity.io/advisories/534
Low Regular Expression Denial of Service
Package debug
Dependency of karma [dev]
Path karma > socket.io > socket.io-adapter > debug
More info https://nodesecurity.io/advisories/534
Low Regular Expression Denial of Service
Package debug
Dependency of karma [dev]
Path karma > socket.io > socket.io-client > debug
More info https://nodesecurity.io/advisories/534
Low Regular Expression Denial of Service
Package debug
Dependency of karma [dev]
Path karma > socket.io > socket.io-client > engine.io-client >
debug
More info https://nodesecurity.io/advisories/534
Low Regular Expression Denial of Service
Package debug
Dependency of karma [dev]
Path karma > socket.io > socket.io-adapter > socket.io-parser >
debug
More info https://nodesecurity.io/advisories/534
Low Regular Expression Denial of Service
Package debug
Dependency of karma [dev]
Path karma > socket.io > socket.io-client > socket.io-parser >
debug
More info https://nodesecurity.io/advisories/534
Low Regular Expression Denial of Service
Package debug
Dependency of karma [dev]
Path karma > socket.io > socket.io-parser > debug
More info https://nodesecurity.io/advisories/534
High Denial of Service
Package ws
Dependency of karma [dev]
Path karma > socket.io > engine.io > ws
More info https://nodesecurity.io/advisories/550
High Denial of Service
Package ws
Dependency of karma [dev]
Path karma > socket.io > socket.io-client > engine.io-client > ws
More info https://nodesecurity.io/advisories/550
High Regular Expression Denial of Service
Package parsejson
Dependency of karma [dev]
Path karma > socket.io > socket.io-client > engine.io-client >
parsejson
More info https://nodesecurity.io/advisories/528
Low Cryptographically Weak PRNG
Package randomatic
Dependency of karma [dev]
Path karma > chokidar > anymatch > micromatch > braces >
expand-range > fill-range > randomatic
More info https://nodesecurity.io/advisories/157
# Run npm install --save-dev protractor@5.3.2 to resolve 8 vulnerabilities
High Denial of Service
Package https-proxy-agent
Dependency of protractor [dev]
Path protractor > saucelabs > https-proxy-agent
More info https://nodesecurity.io/advisories/593
High Denial of Service
Package ws
Dependency of protractor [dev]
Path protractor > webdriver-js-extender > selenium-webdriver > ws
More info https://nodesecurity.io/advisories/550
Moderate Prototype pollution
Package hoek
Dependency of protractor [dev]
Path protractor > webdriver-manager > request > hawk > boom >
hoek
More info https://nodesecurity.io/advisories/566
Moderate Prototype pollution
Package hoek
Dependency of protractor [dev]
Path protractor > webdriver-manager > request > hawk > cryptiles
> boom > hoek
More info https://nodesecurity.io/advisories/566
Moderate Prototype pollution
Package hoek
Dependency of protractor [dev]
Path protractor > webdriver-manager > request > hawk > hoek
More info https://nodesecurity.io/advisories/566
Moderate Prototype pollution
Package hoek
Dependency of protractor [dev]
Path protractor > webdriver-manager > request > hawk > sntp >
hoek
More info https://nodesecurity.io/advisories/566
High Regular Expression Denial of Service
Package sshpk
Dependency of protractor [dev]
Path protractor > webdriver-manager > request > http-signature >
sshpk
More info https://nodesecurity.io/advisories/606
Moderate Out-of-bounds Read
Package stringstream
Dependency of protractor [dev]
Path protractor > webdriver-manager > request > stringstream
More info https://nodesecurity.io/advisories/664
# Run npm update fill-range --depth 5 to resolve 1 vulnerability
Low Cryptographically Weak PRNG
Package randomatic
Dependency of stylelint [dev]
Path stylelint > micromatch > braces > expand-range > fill-range
> randomatic
More info https://nodesecurity.io/advisories/157
```
**Expected behavior:**
Not have high vulnerabilities.
**Steps to reproduce:**
Clone project starter-kit and run npm install
### Other information:
- Angular CLI: 6.0.0
- Node: 8.9.3
- NPM: 6.1.0
- OS: win32 x64
- Angular: 6.0.0
Thank you and excuse me for my English.
Regards
コントリビューションガイド
評価
この issue はまだ評価されていません。