[BUG] npm audit not finding vulnerabilities
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
I have CI pipeline that checks regularly for security issues in the npm packages. For example, it reports about https://www.npmjs.com/advisories/1745.
I do have the infected package in my local machine:
Although in the local machine it doesn't see any high severity vulnerabilities:
And not finding the 1745 issue at all...
Expected Behavior
All security issues (especially high severity vulnerabilities) should appear immediately!
Steps To Reproduce
- Create a CRA new project
- Run
npm audit - You will not see this high severity vulnerability
Environment
- OS: Windows 10
- Node: 15.12.0
- npm: 7.10.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the report by creating a CRA project and running npm audit with the stated Node and npm versions. Check how npm CLI processes advisory 1745 and compare the local audit result with the reported vulnerability. Done means the high-severity vulnerability is reported by npm audit.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100