I trust you are doing well. I wanted to draw your attention to a potential security concern that I've identified in our recently incorporated package. I ran a vulnerability scan using Vulert on the lock file and it uncovered more than 3 potentially at-risk dependencies.
Considering the potential dangers these vulnerabilities may present to our project, I'm uncertain about the correct process for responsible disclosure. It's important to highlight that although some of these dependencies are strictly for development, their presence in the lock file suggests a possibility of them appearing in the vendor folder, hence underlining the need for their effective management.
I strongly suggest that we act swiftly to address these vulnerabilities to safeguard the integrity of our project. Should you require additional information or a comprehensive understanding, don't hesitate to get in touch with me.
Dear Team,
I trust you are doing well. I wanted to draw your attention to a potential security concern that I've identified in our recently incorporated package. I ran a vulnerability scan using Vulert on the lock file and it uncovered more than 3 potentially at-risk dependencies.
Considering the potential dangers these vulnerabilities may present to our project, I'm uncertain about the correct process for responsible disclosure. It's important to highlight that although some of these dependencies are strictly for development, their presence in the lock file suggests a possibility of them appearing in the vendor folder, hence underlining the need for their effective management.
To provide a comprehensive view, you can review the vulnerability scan report of the package-lock file at the following link: https://vulert.com/vuln-scan/list/e009865f-82ad-4953-9689-0c89e140fa03
I strongly suggest that we act swiftly to address these vulnerabilities to safeguard the integrity of our project. Should you require additional information or a comprehensive understanding, don't hesitate to get in touch with me.
For your ease of reference, you can locate the scanned lock file here: https://github.com/Leonidas-from-XIV/node-xml2js/blob/master/package-lock.json
Your prompt attention and feedback on this matter would be highly appreciated.
Best wishes.