lad icon indicating copy to clipboard operation
lad copied to clipboard

Published 20 hours ago • verified publisher icon ladjs

[Snyk] Fix for 1 vulnerabilities

Open titanism opened this issue 1 year ago • 2 comments

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `yarn` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • template/package.json
    • template/yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory. If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 658/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3		 Information Exposure
SNYK-JS-SANITIZEHTML-6256334		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

titanism avatar Feb 23 '24 16:02 titanism

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@babel/[email protected] Transitive: environment, eval, filesystem, network, shell, unsafe +44 6.94 MB nicolo-ribaudo
npm/@babel/[email protected] Transitive: environment +8 113 kB nicolo-ribaudo
npm/@babel/[email protected] None 0 50.5 kB nicolo-ribaudo
npm/@babel/[email protected] environment, filesystem, unsafe +37 5.84 MB nicolo-ribaudo
npm/@babel/[email protected] Transitive: environment, filesystem, unsafe +37 5.84 MB nicolo-ribaudo
npm/@babel/[email protected] Transitive: environment, filesystem, unsafe +42 5.96 MB nicolo-ribaudo
npm/@babel/[email protected] Transitive: environment +12 2.94 MB nicolo-ribaudo
npm/@babel/[email protected] Transitive: environment +2 1.1 MB nicolo-ribaudo
npm/@babel/[email protected] Transitive: environment +2 1.07 MB nicolo-ribaudo
npm/@babel/[email protected] Transitive: environment +22 3.33 MB nicolo-ribaudo
npm/@babel/[email protected] None 0 4.41 kB nicolo-ribaudo
npm/@babel/[email protected] Transitive: environment +7 106 kB nicolo-ribaudo
npm/@babel/[email protected] None 0 1.76 MB nicolo-ribaudo
npm/@babel/[email protected] Transitive: environment, filesystem, unsafe +41 5.86 MB nicolo-ribaudo
npm/@babel/[email protected] Transitive: environment, filesystem, unsafe +41 5.86 MB nicolo-ribaudo
npm/@babel/[email protected] Transitive: environment, eval, filesystem +1 2.71 MB nicolo-ribaudo
npm/@babel/[email protected] environment Transitive: filesystem, unsafe +121 7.69 MB nicolo-ribaudo
npm/@babel/[email protected] None 0 173 kB nicolo-ribaudo
npm/@babel/[email protected] Transitive: environment +19 3.27 MB nicolo-ribaudo
npm/@babel/[email protected] environment +1 1.05 MB nicolo-ribaudo
npm/@fortawesome/[email protected] None 0 11.8 MB robmadole
npm/@grpc/[email protected] filesystem Transitive: environment +4 415 kB murgatroid99
npm/@hapi/[email protected] None +1 79.5 kB devinivy
npm/@jridgewell/[email protected] None +2 168 kB jridgewell
npm/@koa/[email protected] network Transitive: environment +2 84.8 kB niftylettuce
npm/@ladjs/[email protected] environment, network Transitive: filesystem +29 1.86 MB niftylettuce
npm/@ladjs/[email protected] Transitive: environment, filesystem, network +7 938 kB niftylettuce
npm/@ladjs/[email protected] environment Transitive: filesystem, shell +7 288 kB niftylettuce
npm/@ladjs/[email protected] Transitive: environment +2 61.7 kB niftylettuce
npm/@ladjs/[email protected] environment +1 8.09 kB niftylettuce
npm/@ladjs/[email protected] environment +6 420 kB niftylettuce
npm/@ladjs/[email protected] None 0 6.46 kB niftylettuce
npm/@ladjs/[email protected] Transitive: environment +4 91.9 kB niftylettuce
npm/@ladjs/[email protected] environment +4 585 kB shaunwarman
npm/@ladjs/[email protected] None +2 46.6 kB niftylettuce
npm/@ladjs/[email protected] environment +3 114 kB niftylettuce
npm/@ladjs/[email protected] environment, network +1 22.3 kB niftylettuce
npm/@ladjs/[email protected] None 0 12 kB niftylettuce
npm/@ladjs/[email protected] environment, filesystem +1 22.4 kB niftylettuce
npm/@ladjs/[email protected] Transitive: environment +2 60.6 kB niftylettuce
npm/@ladjs/[email protected] environment Transitive: eval, filesystem, network, shell, unsafe +118 12.1 MB titanism
npm/@nodelib/[email protected] filesystem 0 11.8 kB mrmlnc
npm/@primer/[email protected] None +1 4.58 MB primer-css
npm/@protobufjs/[email protected] None 0 9.05 kB dcode
npm/@sidoshi/[email protected] environment 0 26.1 kB sidoshi
npm/@sinonjs/[email protected] None 0 38 kB mrgnrdrck
npm/@sinonjs/[email protected] environment, eval +1 194 kB mrgnrdrck
npm/@slack/[email protected] Transitive: environment, filesystem, network +9 3.68 MB seratch
npm/@strikeentco/[email protected] None 0 5.86 kB strikeentco
npm/@strikeentco/[email protected] None 0 5.13 kB strikeentco
npm/@tkrotoff/[email protected] None +1 4.55 MB tkrotoff
npm/@types/[email protected] None 0 114 kB types
npm/@types/[email protected] None +1 1.71 MB types
npm/@types/[email protected] None 0 32.2 kB types
npm/@types/[email protected] None 0 13.3 kB types
npm/@types/[email protected] None +1 18.1 kB types
npm/@types/[email protected] None 0 3.78 kB types
npm/@types/[email protected] None 0 8.2 kB types
npm/@types/[email protected] None 0 1.68 MB types
npm/@types/[email protected] None 0 6.6 kB types
npm/[email protected] None +1 491 kB rreverser
npm/[email protected] None +2 1.36 MB goto-bus-stop
npm/[email protected] None 0 466 kB marijn
npm/[email protected] environment 0 26.1 kB jonschlinkert
npm/[email protected] None +1 135 kB sindresorhus
npm/[email protected] None 0 4.92 kB jonschlinkert
npm/[email protected] None 0 6.31 kB jonschlinkert
npm/[email protected] None 0 6.17 kB jonschlinkert
npm/[email protected] None 0 4.62 kB dustinspecker
npm/[email protected] environment 0 11.4 kB pfmooney
npm/[email protected] None +1 19.5 kB phated
npm/[email protected] environment Transitive: filesystem +4 2.04 MB ai
npm/[email protected] environment +10 472 kB niftylettuce
npm/[email protected] Transitive: environment, eval, filesystem +2 2.34 MB hzoo
npm/[email protected] Transitive: environment, filesystem, unsafe +38 5.85 MB loganfsmyth
npm/[email protected] None 0 7.55 kB brianloveswords
npm/[email protected] None 0 8.89 kB dougwilson
npm/[email protected] filesystem Transitive: environment +22 217 kB sindresorhus
npm/[email protected] None 0 1.44 MB niftylettuce
npm/[email protected] None 0 100 kB fanatid
npm/[email protected] None 0 1.33 kB feedic
npm/[email protected] None 0 12.5 kB thenativeweb-admin
npm/[email protected] None 0 4.53 MB xhmikosr
npm/[email protected] filesystem Transitive: environment, shell +10 2.43 MB shadowgate15
npm/[email protected] None 0 10.1 kB vl.tansky
npm/[email protected] filesystem +4 96 kB goto-bus-stop
npm/[email protected] filesystem, network, unsafe Transitive: environment +38 1.39 MB goto-bus-stop
npm/[email protected] environment, filesystem +3 1.75 MB ai
npm/[email protected] None 0 33.1 kB niftylettuce
npm/[email protected] eval 0 775 kB nbbeeken
npm/[email protected] None +1 89.6 kB feross
npm/[email protected] Transitive: filesystem +11 1.51 MB goto-bus-stop
npm/[email protected] None 0 12.3 kB dougwilson
npm/[email protected] environment Transitive: network +20 1.42 MB niftylettuce
npm/[email protected] None 0 3.71 kB ashaffer88
npm/[email protected] None 0 11.7 kB sindresorhus
npm/[email protected] None 0 1.5 MB caniuse-lite
npm/[email protected] None 0 8.52 kB grncdr
npm/[email protected] None +1 105 kB nathanhackley
npm/[email protected] None 0 14.3 kB mikeal
npm/[email protected] None 0 17.3 kB forbeslindesay
npm/[email protected] Transitive: network +9 575 kB feedic
npm/[email protected] environment, filesystem +2 149 kB paulmillr
npm/[email protected] None 0 4.84 kB lludol
npm/[email protected] None 0 6.14 kB sindresorhus
npm/[email protected] None 0 91.8 kB obetomuniz
npm/[email protected] None 0 15.9 kB pvorb
npm/[email protected] environment, filesystem, shell +1 108 kB thomasrockhu
npm/[email protected] Transitive: filesystem +1 56.6 kB thlorenz
npm/[email protected] None +1 19.5 kB alexindigo
npm/[email protected] None 0 228 kB fatfisz
npm/[email protected] None 0 7.36 kB dougwilson
npm/[email protected] None +2 19.6 kB mafintosh
npm/[email protected] environment, filesystem, network 0 15 kB isaacs
npm/[email protected] None 0 12.7 kB iarna
npm/[email protected] None 0 1.61 kB paulmillr
npm/[email protected] filesystem, unsafe Transitive: environment, eval +1 691 kB niftylettuce
npm/[email protected] None 0 19.1 kB dougwilson
npm/[email protected] None 0 3.27 kB sindresorhus
npm/[email protected] filesystem 0 10.3 kB thlorenz
npm/[email protected] None 0 14.4 kB andyburke
npm/[email protected] None 0 5.03 kB dead_horse
npm/[email protected] Transitive: environment, filesystem +5 2.35 MB zloirock
npm/[email protected] environment, eval, filesystem 0 2.26 MB zloirock
npm/[email protected] None 0 14.3 kB sindresorhus
npm/[email protected] None 0 5.33 kB bahamas10
npm/[email protected] Transitive: filesystem, unsafe +10 152 kB evilebottnawi
npm/[email protected] filesystem Transitive: environment, network +12 853 kB niftylettuce
npm/[email protected] Transitive: eval +3 444 kB medikoo
npm/[email protected] None 0 7.27 kB jonschlinkert
npm/[email protected] Transitive: environment +3 753 kB niftylettuce
npm/[email protected] None 0 642 kB iamkun
npm/[email protected] environment +1 49.2 kB qix
npm/[email protected] None 0 9.69 kB substack
npm/[email protected] None 0 8.11 kB thlorenz
npm/[email protected] environment, eval 0 27.1 kB dougwilson
npm/[email protected] None +3 142 kB feedic
npm/[email protected] None 0 11.4 kB feedic
npm/[email protected] None +1 55.9 kB feedic
npm/[email protected] network +4 199 kB feedic
npm/[email protected] None +1 11.4 kB zertosh
npm/[email protected] None +1 24.5 kB mafintosh
npm/[email protected] None 0 20.6 kB d2l-travis-deploy
npm/[email protected] environment, filesystem Transitive: eval, unsafe +14 1.49 MB niftylettuce
npm/[email protected] None 0 7.86 kB dougwilson
npm/[email protected] None +2 1.22 MB ljharb
npm/[email protected] eval +3 444 kB medikoo
npm/[email protected] Transitive: eval +3 444 kB medikoo
npm/[email protected] Transitive: eval +3 444 kB medikoo
npm/[email protected] Transitive: eval +4 456 kB medikoo
npm/[email protected] None 0 3.66 kB dougwilson
npm/[email protected] None 0 5.54 kB niftylettuce
npm/[email protected] environment +8 416 kB sindresorhus
npm/[email protected] filesystem Transitive: environment, eval, shell, unsafe +21 5.03 MB eslintbot

🚮 Removed packages: npm/@babel/[email protected], npm/@babel/[email protected], npm/@babel/[email protected], npm/@babel/[email protected], npm/@nodelib/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected]

View full report↗︎

socket-security[bot] avatar Feb 24 '24 07:02 socket-security[bot]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSource
Install scripts npm/@fortawesome/[email protected]
  • Install script: postinstall
  • Source: node attribution.js
Protestware/Troll package npm/[email protected]
  • Note: This package prints a protestware console message on install regarding Ukraine for users with Russian language locale
Install scripts npm/[email protected]
  • Install script: postinstall
  • Source: node -e "try{require('./_postinstall')}catch(e){}" || exit 0

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

What is protestware?

This package is a joke, parody, or includes undocumented or hidden behavior unrelated to its primary function.

Consider that consuming this package my come along with functionality unrelated to its primary purpose.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

socket-security[bot] avatar Feb 24 '24 07:02 socket-security[bot]