sudo-prompt is unmaintained and deprecated

[jayvdb]

Pre-flight checklist

• [x] I have read the contribution documentation for this project.
• [x] I agree to follow the code of conduct that this project uses.
• [x] I have searched the issue tracker for a feature request that matches the one I want to file, without success.

Problem description

I think it is fairly common security best practise to avoid dependencies that are unmaintained / deprecated.

https://www.npmjs.com/package/sudo-prompt is marked deprecated with "Author message": Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

All versions are deprecated at https://www.npmjs.com/package/sudo-prompt?activeTab=versions

Its repo https://github.com/jorangreef/sudo-prompt was archived on Sep 24, 2021

There are no vulns listed against it at https://osv.dev/list?q=sudo-prompt&ecosystem=

and none of the old issues at https://github.com/jorangreef/sudo-prompt/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen scream CVE.

Proposed solution

Replace sudo-prompt with an alternative.

Alternatives considered

Interestingly https://github.com/electron/forge/issues/58 proposed an alternative, but it was rejected.

Additional information

No response

[malept]

The alternative from #58 was rejected for missing macOS support, which the linked issue is still open. So that's still not a viable alternative.

There's no reason why we can't use sudo-prompt for the time being while it still works for what we use it, if no one comes up with a workable alternative.

[jayvdb]

Does this suggest that it was yanked by NPM themselves, and not the author?

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

If so, that sounds bad.

[danielmain]

I forked electron-sudo, enhanced it with typescript and added NixOS support.

https://github.com/danielmain/electron-sudo-universal

Until electron-forge does not update its dependencies you can use this workaround in your package.json:

  "overrides": {
    "electron-sudo": "git+ssh://[email protected]/danielmain/electron-sudo-universal.git#main"
  }

[gerardbalaoro]

@expo maintains their own fork of sudo-prompt without the deprecated util functions.

[erickzhao]

Thanks for the context @gerardbalaoro! I see VSCode has their own fork as well.

[jorangreef]

Does this suggest that it was yanked by NPM themselves, and not the author?

@jayvdb

No, I marked sudo-prompt as read-only on GitHub some years back, and I only recently deprecated the package fully on NPM—deprecated simply means deprecated.

The reason being that between Electron and VSCode using sudo-prompt, the support burden for me was becoming too high.

Before marking read-only, I asked the Microsoft VSCode team to take over the repo officially, to transfer it to them, but they said they "didn't have the resources" at the time. Since deprecating, I believe they did fork, thankfully!

[erickzhao]

Thanks a million for the additional context @jorangreef! 🙇