This Particular example demonstrates how you can sync paid/captured order status updates from Moltin to trigger emailing generated label from Shippo via Webhook API.
Arbitrary File Write vulnerability found in bin-links before 1.1.5. The package fails to restrict access to folders outside of the intended node_modules folder through the bin field. This allows attackers to create arbitrary files in the system.
WS-2019-0337 - Medium Severity Vulnerability
JavaScript package binary linker
Library home page: https://registry.npmjs.org/bin-links/-/bin-links-1.1.2.tgz
Path to dependency file: sync-moltin-to-shippo/package.json
Path to vulnerable library: sync-moltin-to-shippo/node_modules/npm/node_modules/bin-links/package.json
Dependency Hierarchy: - semantic-release-15.13.15.tgz (Root Library) - npm-5.1.7.tgz - npm-6.9.0.tgz - :x: **bin-links-1.1.2.tgz** (Vulnerable Library)
Found in HEAD commit: 9751f50f3931bb08d4180d1a57d5aa27c2f66225
Arbitrary File Write vulnerability found in bin-links before 1.1.5. The package fails to restrict access to folders outside of the intended node_modules folder through the bin field. This allows attackers to create arbitrary files in the system.
Publish Date: 2019-12-11
URL: WS-2019-0337
Base Score Metrics not available
Type: Upgrade version
Origin: https://github.com/npm/bin-links/commit/642cd1890d1e0ca32b5f9ceadc6a587d94a63d69
Release Date: 2019-12-17
Fix Resolution: bin-links - 1.1.5
Step up your Open Source Security Game with WhiteSource here