npm6 vulnerability

[caub]

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack [dev]                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack > watchpack > chokidar > fsevents > node-pre-gyp >   │
│               │ rc > deep-extend                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/612                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack-dev-server [dev]                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack-dev-server > chokidar > fsevents > node-pre-gyp > rc │
│               │ > deep-extend                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/612                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

Edit: It's fixed in 9423fae and #40

• rc got updated: dominictarr/rc@b633779
• node-pre-gyp Update rc to ^1.2.7 in package.json mapbox/node-pre-gyp#379
• fsevents needs to update node-pre-gyp
• chokidar needs to update fsevents
• webpack-dev-server and watchpack needs to update chokidar
• webpack needs to update watchpack

[guylepage3]

+1. Just ran into this issue.

[whackdev]

+1. Encountering same, security report advise update to 0.5.1 or higher will resolve but I still get the same issue.

[theRealSheng]

+1

[ThLewis]

+1

[ichthub]

I still have the same problem even after upgrading to the new released version ("version": "0.5.1",)

[EmersonCDias]

Me too, with GULP.

[KDCinfo]

Just hit this with my React TypeScript app. Vulnerabilities: deep-extend: 9

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts-ts [dev]                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-scripts-ts > fsevents > node-pre-gyp > rc >            │
│               │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/612                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

Tried manually installing/updating deep-extend to 0.5.1 to no avail. Tried my old pacakge.json with no luck. Afraid to publish (GH-Pages; Travis CI) based on what the hoek dependency did a few weeks back.

Edit: When I upgraded to [email protected], the number of deep-extend vulnerabilities went from 11 down to 9 (and all the randomatic vulnerabilities resolved).

[mahdifani14]

Same security issue using nodemon:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.5.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ nodemon [dev]                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ nodemon > chokidar > fsevents > node-pre-gyp > rc >          │
│               │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/612                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

[mohsen1]

This was fixed in #40

9423fae#diff-5202fc56f6565a0319e4cbad698a7255

There is a PR outstanding for rc
dominictarr/rc#103

[rob-orr]

Ugh. @unclechu Any idea why this is still showing up as a vulnerability?

[unclechu]

@rob-orr No, I don't. I'm actually not very in touch with javascript world these days. So I'd expect someone else to write a test that reproduces it and then I could fix it.

[guillermodoghel]

+1

[unclechu]

@caub @rob-orr I've tested it by new npm audit command and it detected vulnerability in mocha package from devDependencies, I fixed it and released with v0.6.0, so I think it is fixed for now? Could you please check and confirm if it's okay with latest version?

P.S. As a side-effect I dropped support of older versions of node.js and io.js because they're failing on Travis-CI by those new versions of devDependencies.

[rob-orr]

@unclechu Thanks, much appreciated! We've tested it and it is passing our scanner. Now we just need rc and closure-loader to update their dependencies!

[unclechu]

@rob-orr Thank you for the response, I'm closing the issue as fixed.