search

NRCHKB / node-red-contrib-homekit-bridged

Node-RED Contribution - HomeKit Bridged : Node-RED nodes to simulate Apple HomeKit devices.
https://nrchkb.github.io
MIT License
412 stars 52 forks source link

[Help needed]: Failed to install but seems to of installed ok? critical security issues #550

Open dansonamission opened 3 months ago

dansonamission commented 3 months ago

Your Current NRCHKB Plugin Version

1.6.1

Operating System

No response

How can we help?

Tried installing the pallet but it errored saying it couldnt be installed, but it seems like it has installed?

2024-04-02T13:01:00.729Z Install : node-red-contrib-homekit-bridged 1.6.1

2024-04-02T13:01:00.801Z npm install --no-audit --no-update-notifier --no-fund --save --save-prefix=~ --production --engine-strict node-red-contrib-homekit-bridged@1.6.1 2024-04-02T13:01:08.299Z [err] npm 2024-04-02T13:01:08.303Z [err]
2024-04-02T13:01:08.304Z [err] WARN config production Use --omit=dev instead. 2024-04-02T13:02:20.170Z [err] npm 2024-04-02T13:02:20.171Z [err] WARN deprecated vm2@3.9.19: The library contains critical security issues and should not be used for production! The maintenance of the project has been discontinued. Consider migrating your code to isolated-vm. 2024-04-02T13:02:52.251Z [out] 2024-04-02T13:02:52.251Z [out] added 260 packages in 2m 2024-04-02T13:02:52.346Z rc=0

Any more details?

If this is specific to some hardware or specific software version, please explain here.

Any code or functions to add?

No response

caitken-com commented 3 months ago

Hi @dansonamission, I checked the dependencies of the project, it’s not directly required. Might be a dependency of another dependency?

It’s been depreciated for over a year now, not sure why no one else has had this issue though. https://www.npmjs.com/package/vm2

Maybe see if you can remove vm2 package.

Shaquu commented 3 weeks ago

I do not see any vm2 here?

+-- node-red-contrib-homekit-bridged@1.6.1
| +-- @nrchkb/logger@2.0.2
| | +-- @types/debug@4.1.12
| | | `-- @types/ms@0.7.34
| | `-- debug@4.3.5
| |   `-- ms@2.1.2
| +-- hap-nodejs@0.11.1
| | +-- @homebridge/ciao@1.2.0
| | | +-- debug@4.3.5 deduped
| | | +-- fast-deep-equal@3.1.3
| | | +-- source-map-support@0.5.21 deduped
| | | `-- tslib@2.6.3 deduped
| | +-- @homebridge/dbus-native@0.5.1
| | | +-- @homebridge/long@5.2.1
| | | +-- @homebridge/put@0.0.8
| | | +-- event-stream@4.0.1
| | | | +-- duplexer@0.1.2
| | | | +-- from@0.1.7
| | | | +-- map-stream@0.0.7
| | | | +-- pause-stream@0.0.11
| | | | | `-- through@2.3.8 deduped
| | | | +-- split@1.0.1
| | | | | `-- through@2.3.8 deduped
| | | | +-- stream-combiner@0.2.2
| | | | | +-- duplexer@0.1.2 deduped
| | | | | `-- through@2.3.8 deduped
| | | | `-- through@2.3.8
| | | +-- hexy@0.2.11
| | | +-- minimist@1.2.8
| | | +-- safe-buffer@5.2.1
| | | `-- xml2js@0.5.0
| | |   +-- sax@1.4.1
| | |   `-- xmlbuilder@11.0.1
| | +-- bonjour-hap@3.6.5
| | | +-- array-flatten@2.1.2
| | | +-- deep-equal@2.2.3
| | | | +-- array-buffer-byte-length@1.0.1
| | | | | +-- call-bind@1.0.7 deduped
| | | | | `-- is-array-buffer@3.0.4 deduped
| | | | +-- call-bind@1.0.7
| | | | | +-- es-define-property@1.0.0
| | | | | | `-- get-intrinsic@1.2.4 deduped
| | | | | +-- es-errors@1.3.0
| | | | | +-- function-bind@1.1.2
| | | | | +-- get-intrinsic@1.2.4 deduped
| | | | | `-- set-function-length@1.2.2
| | | | |   +-- define-data-property@1.1.4
| | | | |   | +-- es-define-property@1.0.0 deduped
| | | | |   | +-- es-errors@1.3.0 deduped
| | | | |   | `-- gopd@1.0.1 deduped
| | | | |   +-- es-errors@1.3.0 deduped
| | | | |   +-- function-bind@1.1.2 deduped
| | | | |   +-- get-intrinsic@1.2.4 deduped
| | | | |   +-- gopd@1.0.1 deduped
| | | | |   `-- has-property-descriptors@1.0.2
| | | | |     `-- es-define-property@1.0.0 deduped
| | | | +-- es-get-iterator@1.1.3
| | | | | +-- call-bind@1.0.7 deduped
| | | | | +-- get-intrinsic@1.2.4 deduped
| | | | | +-- has-symbols@1.0.3
| | | | | +-- is-arguments@1.1.1 deduped
| | | | | +-- is-map@2.0.3
| | | | | +-- is-set@2.0.3
| | | | | +-- is-string@1.0.7
| | | | | | `-- has-tostringtag@1.0.2 deduped
| | | | | +-- isarray@2.0.5 deduped
| | | | | `-- stop-iteration-iterator@1.0.0
| | | | |   `-- internal-slot@1.0.7
| | | | |     +-- es-errors@1.3.0 deduped
| | | | |     +-- hasown@2.0.2 deduped
| | | | |     `-- side-channel@1.0.6 deduped
| | | | +-- get-intrinsic@1.2.4
| | | | | +-- es-errors@1.3.0 deduped
| | | | | +-- function-bind@1.1.2 deduped
| | | | | +-- has-proto@1.0.3
| | | | | +-- has-symbols@1.0.3 deduped
| | | | | `-- hasown@2.0.2
| | | | |   `-- function-bind@1.1.2 deduped
| | | | +-- is-arguments@1.1.1
| | | | | +-- call-bind@1.0.7 deduped
| | | | | `-- has-tostringtag@1.0.2
| | | | |   `-- has-symbols@1.0.3 deduped
| | | | +-- is-array-buffer@3.0.4
| | | | | +-- call-bind@1.0.7 deduped
| | | | | `-- get-intrinsic@1.2.4 deduped
| | | | +-- is-date-object@1.0.5
| | | | | `-- has-tostringtag@1.0.2 deduped
| | | | +-- is-regex@1.1.4
| | | | | +-- call-bind@1.0.7 deduped
| | | | | `-- has-tostringtag@1.0.2 deduped
| | | | +-- is-shared-array-buffer@1.0.3
| | | | | `-- call-bind@1.0.7 deduped
| | | | +-- isarray@2.0.5
| | | | +-- object-is@1.1.6
| | | | | +-- call-bind@1.0.7 deduped
| | | | | `-- define-properties@1.2.1
| | | | |   +-- define-data-property@1.1.4 deduped
| | | | |   +-- has-property-descriptors@1.0.2 deduped
| | | | |   `-- object-keys@1.1.1 deduped
| | | | +-- object-keys@1.1.1
| | | | +-- object.assign@4.1.5
| | | | | +-- call-bind@1.0.7 deduped
| | | | | +-- define-properties@1.2.1 deduped
| | | | | +-- has-symbols@1.0.3 deduped
| | | | | `-- object-keys@1.1.1 deduped
| | | | +-- regexp.prototype.flags@1.5.2
| | | | | +-- call-bind@1.0.7 deduped
| | | | | +-- define-properties@1.2.1 deduped
| | | | | +-- es-errors@1.3.0 deduped
| | | | | `-- set-function-name@2.0.2
| | | | |   +-- define-data-property@1.1.4 deduped
| | | | |   +-- es-errors@1.3.0 deduped
| | | | |   +-- functions-have-names@1.2.3
| | | | |   `-- has-property-descriptors@1.0.2 deduped
| | | | +-- side-channel@1.0.6
| | | | | +-- call-bind@1.0.7 deduped
| | | | | +-- es-errors@1.3.0 deduped
| | | | | +-- get-intrinsic@1.2.4 deduped
| | | | | `-- object-inspect@1.13.1
| | | | +-- which-boxed-primitive@1.0.2
| | | | | +-- is-bigint@1.0.4
| | | | | | `-- has-bigints@1.0.2
| | | | | +-- is-boolean-object@1.1.2
| | | | | | +-- call-bind@1.0.7 deduped
| | | | | | `-- has-tostringtag@1.0.2 deduped
| | | | | +-- is-number-object@1.0.7
| | | | | | `-- has-tostringtag@1.0.2 deduped
| | | | | +-- is-string@1.0.7 deduped
| | | | | `-- is-symbol@1.0.4
| | | | |   `-- has-symbols@1.0.3 deduped
| | | | +-- which-collection@1.0.2
| | | | | +-- is-map@2.0.3 deduped
| | | | | +-- is-set@2.0.3 deduped
| | | | | +-- is-weakmap@2.0.2
| | | | | `-- is-weakset@2.0.3
| | | | |   +-- call-bind@1.0.7 deduped
| | | | |   `-- get-intrinsic@1.2.4 deduped
| | | | `-- which-typed-array@1.1.15
| | | |   +-- available-typed-arrays@1.0.7
| | | |   | `-- possible-typed-array-names@1.0.0
| | | |   +-- call-bind@1.0.7 deduped
| | | |   +-- for-each@0.3.3
| | | |   | `-- is-callable@1.2.7
| | | |   +-- gopd@1.0.1
| | | |   | `-- get-intrinsic@1.2.4 deduped
| | | |   `-- has-tostringtag@1.0.2 deduped
| | | +-- multicast-dns-service-types@1.1.0
| | | `-- multicast-dns@7.2.5
| | |   +-- dns-packet@5.6.1
| | |   | `-- @leichtgewicht/ip-codec@2.0.5
| | |   `-- thunky@1.1.0
| | +-- debug@4.3.5 deduped
| | +-- fast-srp-hap@2.0.4
| | +-- futoin-hkdf@1.4.3
| | +-- node-persist@0.0.11
| | | +-- mkdirp@0.5.6
| | | | `-- minimist@1.2.8 deduped
| | | `-- q@1.1.2
| | +-- source-map-support@0.5.21
| | | +-- buffer-from@1.1.2
| | | `-- source-map@0.6.1
| | +-- tslib@2.6.3 deduped
| | `-- tweetnacl@1.0.3
| +-- ip@2.0.1
| +-- node-persist@3.1.3
| +-- semver@7.6.2
| `-- uuid@9.0.1
`-- passkit-generator@3.1.11
  +-- do-not-zip@1.0.0
  +-- joi@17.4.2
  | +-- @hapi/hoek@9.3.0
  | +-- @hapi/topo@5.1.0
  | | `-- @hapi/hoek@9.3.0 deduped
  | +-- @sideway/address@4.1.5
  | | `-- @hapi/hoek@9.3.0 deduped
  | +-- @sideway/formula@3.0.1
  | `-- @sideway/pinpoint@2.0.0
  +-- node-forge@1.3.1
  `-- tslib@2.6.3