Audit vulnerabilities detected in the createhash project on Tag: v1.2.0
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Stale
- Tech stack
- javascript
- Domain
- security
Research direction
Start in the project root at package.json and run npm audit to confirm the reported trim-newlines and meow dependency vulnerabilities. Apply the suggested dependency remediation, then rerun npm audit; done means the reported high-severity vulnerabilities are resolved without breaking the project.
Written by the indexing model from the issue text.
Description
Issue: We detected vulnerable dependencies in your project by using the command “npm audit”:
npm audit report
trim-newlines <3.0.1 || =4.0.0
Severity: high
Regular Expression Denial of Service - https://npmjs.com/advisories/1753
fix available via npm audit fix
node_modules/trim-newlines
meow 3.4.0 - 5.0.0
Depends on vulnerable versions of trim-newlines
node_modules/meow
2 high severity vulnerabilities
To address all issues, run:
npm audit fix
Questions: We are conducting a research study on vulnerable dependencies in open-source JS projects. We are curious:
- Will you fix the vulnerabilities mentioned above? (Yes/No), and why?:
- Do you have any additional comments? (If so, please write it down):
For any publication or research report based on this study, we will share all responses from developers in an anonymous way. Both your projects and personal information will be kept confidential.
Description: Many popular NPM packages have been found vulnerable and may carry significant risks [1]. Developers are recommended to monitor and avoid the vulnerable versions of the library. The vulnerabilities have been identified and reported by other developers, and their descriptions are available in the npm registry [2].
Steps to reproduce:
- Go to the root folder of the project where the package.json file located
- Execute “npm audit”
- Look at the list of vulnerabilities reported
Suggested Solution: Npm has introduced the “npm audit fix” command to fix the vulnerabilities. Execute the command to apply remediation to the dependency tree.
References:
2019. 10 npm Security Best Practices. https://snyk.io/blog/ten-npm-security-best-practices/.
2021. npm-audit. https://docs.npmjs.com/cli/v7/commands/npm-audit.
- Dominant language
- JavaScript
- Stars
- 53
- Forks
- 37
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from browserify/createHash
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
browserify/createHash#30 · 1 comment · 2 reactions ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
browserify/createHash#29 · 3 comments · 6 reactions ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 25/100
browserify/createHash#28 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
browserify/createHash#26 · 5 comments · 6 reactions ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
browserify/createHash#20 · 8 comments · 1 reaction ·
All issues in browserify/createHash
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
palladius/rails8-app-on-gcp#145 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
dotenvx/dotenv-vscode#139 ·
-
test-change-proposal
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
web-platform-tests/interop#1455 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
corsairdev/corsair#1764 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100