Security Issue: Remove `event-stream` dependency.

gulp-community / gulp-livereload

gulp plugin for livereload

768 stars 67 forks source link

Security Issue: Remove `event-stream` dependency. #139

Closed TheSeg closed 5 years ago

TheSeg commented 5 years ago

As noted in this issue, event-stream is compromised and the original maintainer doesn't have control over the repo.

backflip commented 5 years ago

Locking it to 3.3.4 might be a quick fix for now (and npm has taken ownership of the package in the meantime).

ragesoss commented 5 years ago

I note that the bad version has been yanked from npm, but the current default with gulp-reload will be to include 3.3.5, which is (I guess?) benign but does include (only) changes by the bad actor who went on to add the malicious code in 3.3.6.

demurgos commented 5 years ago

The dependency was pinned to 3.3.4 in #140 (released as version 4.0.1). Please send a PR (or message) when the problem is resolved.