package-lock.json forces a compromised version of event-stream

ILLGrenoble / ngx-remote-desktop

Angular component for accessing remote desktops using guacamole

https://illgrenoble.github.io/ngx-remote-desktop/

MIT License

35 stars 38 forks source link

package-lock.json forces a compromised version of event-stream #11

Open wescopeland opened 5 years ago

wescopeland commented 5 years ago

Cloning the repo and performing an npm install is currently not possible without first deleting the package-lock.json. Something in the lockfile is referencing a version of event-stream that was pulled off npm because of a vulnerability involving stealing cryptocurrency.

MarkBoote commented 5 years ago

Had the same problem. Edited package.json to change "npm-run-all" to version "^4.1.5". npm install then worked fine (without having to delete package-lock.json).