search

ifandelse / machina.js

js ex machina - finite state machines in JavaScript
http://machina-js.org/
Other
1.93k stars 147 forks source link

Prevent potential problems from a future colors@>1.4.0 upgrade #173

Open jgonggrijp opened 2 years ago

jgonggrijp commented 2 years ago

After reading https://snyk.io/blog/open-source-npm-packages-colors-faker/ and https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/, I decided to scan all JavaScript repositories on my hard drive for direct and indirect dependencies on the affected packages, using the following terminal command:

find . \( -name package-lock.json -or -name yarn.lock \) -exec grep -E 'colors|faker|node-ipc|js-queue|easy-stack|js-message|event-pubsub|node-cmd' '{}' ';' -print

(In case others want to run the same command, keep in mind that the path to the matching package-lock.json or yarn.lock comes after the matching lines output by grep.)

I found several projects that depended on colors, including machina. The patch should ensure that no affected version is installed by accident, even when upgrading intermediate dependencies.