Closed derkrasseleo closed 1 year ago
@leochras
This seems to be regarding the Jest testing dependency, which isn't bundled within the distributed library code and only used in development.
So you can safely disregard that message for now - i'm always trying to keep the dependencies up-to-date and i'm updating those before each new release (https://github.com/marcopixel/r6operators/commit/ad7ae7b46d3cb8b0427f9356ef56965badfe52f3, https://github.com/marcopixel/r6operators/commit/ecb55b5095dcb6565dd68fa2fa23e5cbbe07d47f, https://github.com/marcopixel/r6operators/commit/df7491bc3c470848d22b7ffdb00e8399e81b0211) so you should be fine.
Perfect, as I said, just wanted to let you know
I just got an email telling me there's a security risk in this repo. I am not sure if this is spam or if it's really relevant but here's the email:
I translated it because it was written in chinese:
Hello leochras
I'm ren_jq, a security expert in the OSCS community. I recently noticed your open source project marcopixel/r6operators on GitHub and found some security flaws in the project through the OSCS community security tools, so I created a community team to try to help improve the security of the open source project.
I found that you are a contributor to the marcopixel/r6operators project, so I took the liberty to share the security report with you, and if you are interested, you can also join us to focus on the security of the project. View the detailed test report If the button is not clickable, please copy the link to your computer browser to open: https://www.murphysec.com/accept?code=ba3c5425b5df2bb5ce699d791ebb9ef0&type=1&from=2&t=1 Temporarily not concerned, choose to ignore
Inspection results provided by Murphy Security, a professional code security inspection tool Murphy Security is the technical support unit of the National Security Vulnerability Database (CNNVD) and has passed ISO9001, ISO27001, CCRC and other authoritative certifications. Murphy Security has been used by 700 companies such as Ant Group, Ping An and Meituan, and is also loved by over 10,000+ developers With an overview of the test results of marcopixel/r6operators:
Details of some defective components: Flawed component: json5 - Indirect Dependencies
Yours sincerely, OSCS Security Community
Good luck and happy life!