forwardemail.net icon indicating copy to clipboard operation
forwardemail.net copied to clipboard

Published 20 hours ago • verified publisher icon forwardemail

[Snyk] Fix for 3 vulnerabilities

Open titanism opened this issue 1 year ago • 2 comments
trafficstars

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `yarn` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory. If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning 
Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-AXIOS-6144788		 Yes No Known Exploit
medium severity 631/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.2		 Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-NODEMAILER-6219989		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution 🦉 Regular Expression Denial of Service (ReDoS)

titanism avatar Feb 26 '24 16:02 titanism

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@babel/[email protected] Transitive: environment, filesystem, unsafe +1 892 kB nicolo-ribaudo
npm/@babel/[email protected] environment, filesystem, unsafe 0 778 kB nicolo-ribaudo
npm/@babel/[email protected] None 0 443 kB nicolo-ribaudo
npm/@babel/[email protected] environment Transitive: filesystem, unsafe +1 926 kB nicolo-ribaudo
npm/@commitlint/[email protected] None 0 30.6 kB escapedcat
npm/@commitlint/[email protected] None 0 18.6 kB escapedcat
npm/@ladjs/[email protected] None 0 4.13 kB titanism
npm/@ladjs/[email protected] environment 0 3.11 kB niftylettuce
npm/@ladjs/[email protected] None 0 6.85 kB shadowgate15
npm/@ladjs/[email protected] environment, filesystem 0 144 kB shadowgate15
npm/@prettier/[email protected] None 0 356 kB shinigami92
npm/@ronilaukkarinen/[email protected] filesystem 0 17.6 kB ronilaukkarinen
npm/[email protected] None +6 377 kB novemberborn
npm/[email protected] Transitive: filesystem +2 2.91 MB kaicataldo
npm/[email protected] filesystem, network, unsafe +1 371 kB goto-bus-stop
npm/[email protected] None 0 13.5 kB goto-bus-stop
npm/[email protected] None +2 1.47 MB titanism
npm/[email protected] None 0 7.01 kB ludovicofischer
npm/[email protected] None +1 21.4 kB sindresorhus
npm/[email protected] None 0 15.6 kB titanism
npm/[email protected] environment 0 8.83 kB sindresorhus
npm/[email protected] filesystem +2 2.93 MB amilajack
npm/[email protected] None 0 11.9 kB seansleblanc
npm/[email protected] filesystem +1 2.88 MB eslintbot
npm/[email protected] environment, filesystem 0 48 kB substack
npm/[email protected] None 0 755 kB aexmachina
npm/[email protected] filesystem 0 9.88 kB henrikjoreteg
npm/[email protected] None 0 48.5 kB tricinel
npm/[email protected] None 0 5.29 MB highlightjs_bot
npm/[email protected] None 0 96.5 kB mdevils
npm/[email protected] None 0 198 kB killy.mxi
npm/[email protected] None 0 314 kB thedaviddias
npm/[email protected] None 0 3.8 kB sindresorhus
npm/[email protected] None 0 669 kB kewisch
npm/[email protected] None 0 5.24 MB bnoordhuis
npm/[email protected] network +3 1.29 MB andris
npm/[email protected] None 0 7.45 kB sindresorhus
npm/[email protected] None 0 26.9 kB andris
npm/[email protected] None 0 13.6 kB indutny
npm/[email protected] None 0 60.2 kB whitequark
npm/[email protected] None 0 3.81 kB sibiraj-s
npm/[email protected] None 0 3.29 kB parroit
npm/[email protected] None 0 2.49 kB sindresorhus
npm/[email protected] None 0 13.5 kB niftylettuce
npm/[email protected] None 0 93.5 kB omrilotan
npm/[email protected] None 0 1.32 MB timmywil
npm/[email protected] None 0 36 kB loonywizard
npm/[email protected] eval, filesystem, network, shell, unsafe Transitive: environment +3 4.07 MB domenic
npm/[email protected] None 0 60 kB 2do2go
npm/[email protected] None 0 22.6 kB d2l-travis-deploy
npm/[email protected] None 0 409 kB rijk
npm/[email protected] environment, filesystem Transitive: shell +2 2.46 MB kibertoad
npm/[email protected] None 0 15 kB fengmk2
npm/[email protected] None 0 9.26 kB niftylettuce
npm/[email protected] None 0 17.1 kB niftylettuce
npm/[email protected] environment +2 87 kB titanism
npm/[email protected] None 0 16.9 kB rkusa
npm/[email protected] None 0 156 kB niftylettuce
npm/[email protected] None 0 41.5 kB viktorbergehall
npm/[email protected] None 0 14.3 kB tuupola
npm/[email protected] None 0 146 kB andris
npm/[email protected] network Transitive: environment, filesystem, shell +5 2.34 MB andris
npm/[email protected] None +2 267 kB andris
npm/[email protected] None +1 216 kB andris
npm/[email protected] environment, filesystem, network +12 3.61 MB titanism
npm/[email protected] environment 0 12.7 kB shaunwarman
npm/[email protected] None 0 201 kB vitaly
npm/[email protected] None 0 18.7 kB flet
npm/[email protected] None +1 5.32 MB valeriangalliat
npm/[email protected] None 0 76.9 kB linsir
npm/[email protected] Transitive: environment, filesystem +1 735 kB vitaly
npm/[email protected] None 0 55.6 kB medikoo
npm/[email protected] None +2 23.3 MB knsv
npm/[email protected] environment, filesystem 0 107 kB isaacs
npm/[email protected] None 0 4.54 kB nodkz
npm/[email protected] None +1 1.46 MB devtoolsbot
npm/[email protected] None 0 5.93 kB thehippo
npm/[email protected] Transitive: environment, network +10 3.95 MB titanism
npm/[email protected] None 0 11.6 kB niftylettuce
npm/[email protected] Transitive: environment, network +2 2.37 MB viveleroi
npm/[email protected] None +3 1.43 MB niftylettuce
npm/[email protected] environment, network +1 2.31 MB vkarpov15
npm/[email protected] filesystem +1 30 kB linusu
npm/[email protected] network Transitive: environment, filesystem, shell +6 2.41 MB andris
npm/[email protected] None 0 3.93 kB rebs
npm/[email protected] None 0 165 kB taoqf
npm/[email protected] filesystem +1 761 kB jens-maus
npm/[email protected] filesystem, shell 0 37 kB sunilwang
npm/[email protected] None 0 502 kB andris
npm/[email protected] None 0 336 kB adamwdraper
npm/[email protected] environment 0 22.3 MB larabr
npm/[email protected] None 0 25.6 kB geraldyeo
npm/[email protected] None +1 34.1 kB sindresorhus
npm/[email protected] None +1 13.3 kB sindresorhus
npm/[email protected] None 0 5.63 kB sindresorhus
npm/[email protected] None 0 8.69 kB sindresorhus
npm/[email protected] None +1 38.3 kB sindresorhus
npm/[email protected] None 0 6.14 kB sindresorhus
npm/[email protected] None 0 11 kB sindresorhus
npm/[email protected] None +1 11.3 kB sindresorhus
npm/[email protected] None 0 9.42 kB sindresorhus
npm/[email protected] None 0 5.75 kB sindresorhus
npm/[email protected] None 0 4.75 kB sindresorhus
npm/[email protected] None 0 283 kB peeri
npm/[email protected] None 0 19.3 kB titanism
npm/[email protected] None +3 1.47 MB titanism
npm/[email protected] None +1 56.7 kB saintedlama
npm/[email protected] environment, network 0 84.9 kB paypal
npm/[email protected] None 0 8.87 kB sindresorhus
npm/[email protected] None 0 17.7 kB blakeembrey
npm/[email protected] None 0 1.72 MB fezvrasta
npm/[email protected] None 0 5.13 kB ai
npm/[email protected] None 0 62.5 kB mlm
npm/[email protected] None 0 10.7 kB ludovicofischer
npm/[email protected] None 0 8.97 kB beneb
npm/[email protected] None 0 10.9 kB ludovicofischer
npm/[email protected] None 0 13.9 kB ai
npm/[email protected] None 0 6.87 kB tomasklaen
npm/[email protected] None 0 4.62 kB indexzero
npm/[email protected] None 0 8.25 kB faisal_manzer
npm/[email protected] None 0 10.1 kB niftylettuce
npm/[email protected] None 0 11.5 kB sindresorhus
npm/[email protected] None 0 12 kB sindresorhus
npm/[email protected] environment, filesystem, network, shell Transitive: eval +9 902 kB titanism
npm/[email protected] environment, eval, filesystem 0 59.7 kB pug-bot
npm/[email protected] None 0 331 kB google-wombot, mathias
npm/[email protected] filesystem 0 135 kB soldair
npm/[email protected] None 0 241 kB ljharb
npm/[email protected] None 0 11.7 MB elazutkin
npm/[email protected] None 0 156 kB pladaria
npm/[email protected] None 0 9.48 kB ionicabizau
npm/[email protected] None 0 30.3 kB titanism
npm/[email protected] None 0 3.32 kB sindresorhus
npm/[email protected] None 0 687 kB davidgoli
npm/[email protected] None 0 62.7 kB alexbea, alexgilbert, austinstarin, ...14 more
npm/[email protected] None 0 7.93 kB freewil
npm/[email protected] None 0 44.7 kB xyfir
npm/[email protected] environment, filesystem, shell +1 627 kB lovell
npm/[email protected] None 0 37.2 kB klaussinani
npm/[email protected] filesystem, shell 0 170 kB derduher
npm/[email protected] network 0 171 kB andris
npm/[email protected] filesystem 0 14.2 kB broooooklyn
npm/[email protected] environment, filesystem, network +23 29.6 MB titanism
npm/[email protected] None 0 167 kB pid
npm/[email protected] None 0 37 kB tobiasahlin
npm/[email protected] None 0 3.64 kB sindresorhus
npm/[email protected] None 0 7.23 kB alex.garcia
npm/[email protected] None +1 1.5 MB eriwen
npm/[email protected] None 0 12.1 kB dougwilson
npm/[email protected] network, shell +1 3.4 MB stripe-bindings
npm/[email protected] None 0 17.9 kB ericnorris
npm/[email protected] environment, filesystem, network +2 820 kB titanism
npm/[email protected] None 0 566 kB limonte
npm/[email protected] network Transitive: environment +7 1.49 MB titanism
npm/[email protected] None 0 3.19 kB sindresorhus
npm/[email protected] network 0 937 kB natelindev
npm/[email protected] environment, filesystem, network +4 10.7 MB twilio-dx
npm/[email protected] None 0 154 kB mattboldt
npm/[email protected] None 0 30.7 kB al88
npm/[email protected] environment, network 0 1.24 MB matteo.collina
npm/[email protected] None 0 63 kB swaagie
npm/[email protected] None +1 11.8 MB titanism
npm/[email protected] None 0 744 kB lpinca
npm/[email protected] None 0 751 kB profnandaa
npm/[email protected] filesystem, network 0 26.6 kB jrit
npm/[email protected] None 0 39.5 kB vitalets
npm/[email protected] environment, filesystem, network Transitive: shell, unsafe +16 33.6 MB andris
npm/[email protected] shell 0 10.7 kB zxlin
npm/[email protected] environment, network +2 1.3 MB lpinca
npm/[email protected] environment, filesystem, network, shell +9 3.19 MB andris

🚮 Removed packages: npm/[email protected]

View full report↗︎

socket-security[bot] avatar Feb 26 '24 16:02 socket-security[bot]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSource
Native code npm/[email protected]
Native code npm/[email protected]
Native code npm/[email protected]
Potential typo squat npm/[email protected]
Native code npm/[email protected]
Install scripts npm/[email protected]
  • Install script: install
  • Source: install-from-cache --artifact build/Release/re2.node --host-var RE2_DOWNLOAD_MIRROR --skip-path-var RE2_DOWNLOAD_SKIP_PATH --skip-ver-var RE2_DOWNLOAD_SKIP_VER || npm run rebuild
Install scripts npm/[email protected]
  • Install script: postinstall
  • Source: node ./postinstall.js

View full report↗︎

Next steps

What's wrong with native code?

Contains native code which could be a vector to obscure malicious code, and generally decrease the likelihood of reproducible or reliable installs.

Ensure that native code bindings are expected. Consumers may consider pure JS and functionally similar alternatives to avoid the challenges and risks associated with native code bindings.

What is a typosquat?

Package name is similar to other popular packages and may not be the package you want.

Use care when consuming similarly named packages and ensure that you did not intend to consume a different package. Malicious packages often publish using similar names as existing popular packages.

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

socket-security[bot] avatar Feb 26 '24 16:02 socket-security[bot]