search

millermedeiros / esformatter

ECMAScript code beautifier/formatter
MIT License
970 stars 91 forks source link

npm audit issue: Tmp files readable by other users #497

Closed zkuzmic closed 4 years ago

zkuzmic commented 5 years ago

Running npm audit on a project with the latest version of esformatter installed results in the following issue:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Tmp files readable by other users                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ sync-exec                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ esformatter [dev]                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ esformatter > npm-run > sync-exec                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/310                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

Proposed resolution: Upgrade the npm-run dependency to version 5.0.1 which no longer has the sync-exec package as a dependency.