search

deoxxa / irc-client

IRC client logic using irc-protocol for communication
Other
6 stars 2 forks source link

npm audit security issue #2

Open telion2 opened 5 years ago

telion2 commented 5 years ago

Steps to reproduce: install angular-cli install irc-client npm audit

Result: 

     === npm audit security report ===                        

                                 Manual Review                                  
             Some vulnerabilities require your attention to resolve             

          Visit https://go.npm.me/audit-guide for additional guidance           

  Critical        Command Injection                                             

  Package         growl                                                         

  Patched in      >=1.10.2                                                      

  Dependency of   irc-client                                                    

  Path            irc-client > irc-protocol > mocha > growl                     

  More info       https://npmjs.com/advisories/146                              

  High            Regular Expression Denial of Service                          

  Package         minimatch                                                     

  Patched in      >=3.0.2                                                       

  Dependency of   irc-client                                                    

  Path            irc-client > irc-protocol > mocha > glob > minimatch          

  More info       https://npmjs.com/advisories/118                              

  Moderate        Regular Expression Denial of Service                          

  Package         ms                                                            

  Patched in      >0.7.0                                                        

  Dependency of   irc-client                                                    

  Path            irc-client > irc-protocol > mocha > ms                        

  More info       https://npmjs.com/advisories/46
telion2 commented 5 years ago

Also tested in node with the same result.