search

pyramation / stargazejs

MIT License
2 stars 2 forks source link

npm audit found 10 vulnerabilities (1 moderate, 9 _high_ ) #1

Open bmorphism opened 2 years ago

bmorphism commented 2 years ago 
# npm audit report

marked  <=4.0.9
Severity: high
Inefficient Regular Expression Complexity in marked - https://github.com/advisories/GHSA-5v2h-r2cx-5xgj
Inefficient Regular Expression Complexity in marked - https://github.com/advisories/GHSA-rrrm-qjm4-v8hf
No fix available
node_modules/marked
  cli-usage  *
  Depends on vulnerable versions of marked
  Depends on vulnerable versions of marked-terminal
  node_modules/cli-usage
    node-notifier  <=8.0.0
    Depends on vulnerable versions of cli-usage
    node_modules/stargaze/node_modules/node-notifier
      stargaze  *
      Depends on vulnerable versions of node-notifier
      node_modules/stargaze
  marked-terminal  <=4.2.0
  Depends on vulnerable versions of marked
  node_modules/marked-terminal

protobufjs  <6.11.3
Severity: high 🌱
Prototype Pollution in protobufjs - https://github.com/advisories/GHSA-g954-5hwp-pp24
fix available via `npm audit fix --force`
Will install @cosmjs/stargate@0.28.7, which is outside the stated dependency range
node_modules/@cosmjs/proto-signing/node_modules/protobufjs
node_modules/@cosmjs/stargate/node_modules/protobufjs
node_modules/cosmwasm-typescript-gen/node_modules/protobufjs
  @cosmjs/proto-signing  <=0.28.4
  Depends on vulnerable versions of protobufjs
  node_modules/@cosmjs/proto-signing
  node_modules/cosmwasm-typescript-gen/node_modules/@cosmjs/proto-signing
    @cosmjs/stargate  <=0.28.5
    Depends on vulnerable versions of @cosmjs/proto-signing
    Depends on vulnerable versions of protobufjs
    node_modules/@cosmjs/stargate
    node_modules/cosmwasm-typescript-gen/node_modules/@cosmjs/stargate
    cosmwasm-typescript-gen  <=0.3.3
    Depends on vulnerable versions of @cosmjs/proto-signing
    Depends on vulnerable versions of @cosmjs/stargate
    node_modules/cosmwasm-typescript-gen
      @osmonauts/telescope  >=0.4.34
      Depends on vulnerable versions of cosmwasm-typescript-gen
      node_modules/@osmonauts/telescope

10 vulnerabilities (1 moderate, 9 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible, run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.
pyramation commented 2 years ago

thanks! I just upgraded and pushed a version with latest packages for most items.

Currently still have prototype pollution in protobufjs via @cosmjs/proto-signing — this seems to be taken care of https://github.com/cosmos/cosmjs/blob/main/packages/proto-signing/package.json#L78 since the version matches up. I'll dig more into why even after upgrading it still shows in audit.

$ yarn audit report
yarn audit v1.22.17
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Prototype Pollution in protobufjs                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ protobufjs                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=6.11.3                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @osmonauts/telescope                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @osmonauts/telescope > cosmwasm-typescript-gen >             │
│               │ @cosmjs/proto-signing > protobufjs                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1070483                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Prototype Pollution in protobufjs                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ protobufjs                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=6.11.3                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @osmonauts/telescope                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @osmonauts/telescope > cosmwasm-typescript-gen >             │
│               │ @cosmjs/stargate > @cosmjs/proto-signing > protobufjs        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1070483                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
2 vulnerabilities found - Packages audited: 787
Severity: 2 High
pyramation commented 2 years ago

I'm working on some telescope upgrades if that's the issue, will be taken care of ASAP.

bmorphism commented 2 years ago

omg! I opened my Inbox and this is already for the most part fixed, at least for the issues that required intervention!

You, Ser, are seriously gmi! appreciate the quick turn-around -- want to use it with a Svelte dApp!