npm6 vulnerability

[caub]

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack [dev]                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack > watchpack > chokidar > fsevents > node-pre-gyp >   │
│               │ rc > deep-extend                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/612                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack-dev-server [dev]                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack-dev-server > chokidar > fsevents > node-pre-gyp > rc │
│               │ > deep-extend                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/612                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

Edit: It's fixed in 9423fae and #40

• rc got updated: dominictarr/rc@b633779
• node-pre-gyp Update rc to ^1.2.7 in package.json mapbox/node-pre-gyp#379
• fsevents needs to update node-pre-gyp
• chokidar needs to update fsevents
• webpack-dev-server and watchpack needs to update chokidar
• webpack needs to update watchpack

[guylepage3]

+1. Just ran into this issue.

[whackdev]

+1. Encountering same, security report advise update to 0.5.1 or higher will resolve but I still get the same issue.

[theRealSheng]

+1

[ThLewis]

+1

[ichthub]

I still have the same problem even after upgrading to the new released version ("version": "0.5.1",)

[EmersonCDias]

Me too, with GULP.

[KDCinfo]

Just hit this with my React TypeScript app. Vulnerabilities: deep-extend: 9

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts-ts [dev]                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-scripts-ts > fsevents > node-pre-gyp > rc >            │
│               │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/612                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

Tried manually installing/updating deep-extend to 0.5.1 to no avail. Tried my old pacakge.json with no luck. Afraid to publish (GH-Pages; Travis CI) based on what the hoek dependency did a few weeks back.

Edit: When I upgraded to react-scripts-ts@3.0.0, the number of deep-extend vulnerabilities went from 11 down to 9 (and all the randomatic vulnerabilities resolved).

[mahdifani14]

Same security issue using nodemon:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.5.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ nodemon [dev]                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ nodemon > chokidar > fsevents > node-pre-gyp > rc >          │
│               │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/612                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

[mohsen1]

This was fixed in #40

9423fae#diff-5202fc56f6565a0319e4cbad698a7255

There is a PR outstanding for rc
dominictarr/rc#103

[rob-orr]

Ugh. @unclechu Any idea why this is still showing up as a vulnerability?

[unclechu]

@rob-orr No, I don't. I'm actually not very in touch with javascript world these days. So I'd expect someone else to write a test that reproduces it and then I could fix it.

[guillermodoghel]

+1