auth0-js 9.26.1 using deprecated version of superagent 7.6.1 which contains references to polyfills.io - responsible for a recent supply chain attack #1447
auth0-js@9.26.1 has a dependency on superagent 7.6.1 which is deprecated. Superagent 7.6.1 contains a README.MD page which mentions about polyfills.io. polyfills.io has been recently linked to a supply chain attack, please see the links below:
Checklist
Description
auth0-js@9.26.1 has a dependency on superagent 7.6.1 which is deprecated. Superagent 7.6.1 contains a README.MD page which mentions about polyfills.io. polyfills.io has been recently linked to a supply chain attack, please see the links below:
You can also find more details on the below site with examples : https://sansec.io/research/polyfill-supply-chain-attack
auth0-js should be updated to use latest superagent dependency version 9 and above.
Reproduction
npm install auth0-js npm ls superagent
README.md
Additional context
We are installing auth0-js using npm and don't use scripts or cdn.
auth0-js version
9.26.1
Which browsers have you tested in?
Chrome