search

imba / imba

🐤 The friendly full-stack language
https://imba.io
MIT License
6.29k stars 175 forks source link

CVE-2022-23812: YOUR CODE IS INFECTED WITH MALICIOUS DEPENDENCY - node-ipc #659

Closed lgg closed 2 years ago

lgg commented 2 years ago

Newest version of node-ipc delete all users's files from device. You should not use this dependency anymore!

You can learn more here: https://gist.github.com/MidSpike/f7ae3457420af78a54b38a31cc0c809c

Check possible solution that already applied in vue.js: https://github.com/vuejs/vue-cli/issues/7054#issuecomment-1068677029

also check more here: https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/

codeluggage commented 2 years ago

We're at 9.1.4 now. Is this still the recommended way to mitigate this? 

  "overrides": {
    "node-ipc@>9.2.1 <10": "9.2.1",
    "node-ipc@>10.1.0": "10.1.0"
  }
somebee commented 2 years ago

Is this not fixed by forcing the exact 9.1.4 version? No longer getting an dependabot alerts.